TRENDnet TEW-WLC100P EUVD-2026-60759

Exploitation requires the attacker to reside on the same Layer 2 network segment as the TEW-WLC100P (AV:A), meaning they must be capable of delivering crafted DHCP traffic directly to the device - this precludes direct exploitation from the public internet but is achievable from any host on the same broadcast domain, including wireless clients associated to the device's own SSID. The DHCP blobmsg handler in /sbin/netifd must be active, which is the case when DHCP server or client functionality is running on the affected interface. No authentication is required (PR:N per the CVSS 4.0 vector) and no user interaction is needed (UI:N). Exploitation is bounded by the adjacent-network requirement; remote attackers without prior local network presence cannot directly trigger the vulnerability. The specific confirmed firmware version is 12.07b01; whether earlier or later firmware versions share the same vulnerable code path is unknown from available data.

The CVSS 4.0 score of 8.6 with full High impact across all six dimensions (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects the severity of unauthenticated arbitrary code execution on a network gateway device, where compromise extends to downstream systems on the network segment. The adjacent-network attack vector (AV:A) limits exposure compared to internet-facing vulnerabilities - direct exploitation from the public internet is not possible without a prior foothold - but in SOHO environments, any wireless or wired client on the segment constitutes a viable attacker position. The CVSS 4.0 supplemental exploit maturity metric E:P confirms public proof-of-concept availability, meaning script-level adversaries can exploit this without developing their own tooling. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing was found, so widespread active exploitation is not confirmed; however, the public POC and no-authentication-required conditions represent a credible near-term exploitation risk. The absence of a vendor patch compounds urgency. Overall, this is a genuine priority for environments running this specific device - not a high-CVSS-but-low-real-risk issue.

An attacker who has obtained access to the same local network segment as a TRENDnet TEW-WLC100P running firmware 12.07b01 - for example, a rogue wireless client or a compromised wired endpoint - runs the publicly available poc-netifd-overflow.py script from GitHub against the device's IP address. The script sends a crafted DHCP message containing an oversized blobmsg field that overflows the stack buffer in /sbin/netifd, overwrites the return address with attacker-controlled data, and redirects execution to a shellcode payload, achieving remote code execution on the gateway with no authentication required.