TRENDnet TEW-821DAP EUVD-2026-43205

Exploitation requires authenticated access to the TEW-821DAP web-management interface (CVSS PR:L) and network reachability to the device, then a crafted HTTP request to the /goform/tools_nslookup endpoint with an oversized nslookup_target parameter that reaches the ssi handler sub_41EC14. Limiting factors: the attacker must already hold valid management credentials (no unauthenticated path is documented), the vulnerable nslookup diagnostic feature must be accessible, and only hardware revision v1.0R firmware 1.12B01 is in scope. The product is end-of-life, so exposure is confined to legacy deployments still running this model, and restricting the admin interface to trusted networks removes the required reach.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects network reachability, low attack complexity, no user interaction, and high impact to confidentiality, integrity and availability, but importantly requires PR:L - the attacker must already be authenticated to the web UI. That single prerequisite substantially lowers real-world risk versus an unauthenticated overflow, because it presumes valid admin credentials or a chained auth bypass. There is no CISA KEV listing and no EPSS score provided, and no public exploit is identified, so there is no evidence of active or automatable exploitation. Two data points conflict and should be flagged: the input marks a patch as 'Available from vendor,' yet the vendor explicitly states the TEW-821DAP is EOL and it cannot confirm the vulnerability - verify patch availability directly with TRENDnet before relying on it. Net assessment: a genuinely serious memory-corruption bug but a lower operational priority than the raw 8.7 suggests, given the authentication requirement, EOL status, and absence of exploitation signals.

An attacker who has obtained valid admin credentials (for example via default/reused passwords or a phishing-harvested login) reaches the router's web console over the network and submits a diagnostic nslookup request with an overlong nslookup_target value. The oversized input overflows the buffer in sub_41EC14, crashing the httpd service or, with a crafted payload, executing attacker code on the device. No public exploit is currently identified, though a public technical writeup describing the overflow exists.