TRENDnet TEW-WLC100 EUVD-2026-60773

Exploitation requires network reachability to the TEW-WLC100's embedded nginx HTTP interface and the ability to send a crafted HTTP request that drives oversized attacker-controlled data into the 'Server' header handling path processed by FUN_0040da4c. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special attack requirement, and no user interaction are needed against the affected firmware. The principal limiting factor is exposure: the attacker must be able to route to the controller's web/management port, so devices confined to isolated management networks are far harder to reach. Confirmed affected scope is limited to firmware 1v2.07b01 on the TEW-WLC100; other builds or models are not established from the available data.

The signals mostly align toward elevated risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated overflow with high impact to confidentiality, integrity, and availability, and the E:P exploit-maturity flag plus a linked GitHub POC confirm public exploit code exists. Countervailing factors temper the picture: this is a single-source VulDB disclosure with no NVD-authored CVSS 3.1 vector, no EPSS score, no CISA KEV listing, and no SSVC decision record provided, so several corroborating data points are simply missing rather than reassuring. No EPSS probability is available to gauge real-world exploitation likelihood, and the absence of KEV means there is no confirmation of active exploitation - the POC signals capability, not campaigns. The device itself is a niche wireless-LAN controller with a small deployment footprint, so mass internet-wide exploitation is less likely than targeted use against exposed management interfaces; any operator that exposes the controller's HTTP interface to untrusted networks should treat this as urgent and patch or isolate it promptly. Net assessment: a genuine high-severity, network-exploitable flaw whose real-world urgency depends heavily on whether the affected controllers are reachable from untrusted networks.

An attacker who can reach the TEW-WLC100's HTTP management interface sends a crafted HTTP request whose Server-header-related input is oversized, overflowing the fixed stack buffer in FUN_0040da4c within the device's nginx binary. Given the low attack complexity and no authentication requirement (AC:L/PR:N/UI:N), a remote actor can trigger memory corruption to crash the service or attempt control-flow hijack for code execution. A public Python POC (poc-nginx-overflow.py) already demonstrates the overflow, lowering the barrier to reproduction.