EUVD-2026-61203
GHSA-v6vr-8j9q-m44g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via HTTP (AV:N), low-privilege authentication required per CVSS 4.0 PR:L, scope changes as compromised camera can pivot against adjacent network systems (S:C), full C/I/A impact on successful exploitation.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
AnalysisAI
Stack-based buffer overflow in the alphapd web server daemon of TRENDnet TV-IP751WIC firmware 11.03.03 allows low-privileged remote attackers to execute arbitrary code by sending malformed input to any of seven vulnerable configuration-handling functions. Seven distinct code paths - SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C - copy user-supplied configuration values onto the stack without enforcing length limits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privileged authenticated access to the alphapd web management interface of the TV-IP751WIC, as confirmed by PR:L in the CVSS 4.0 vector - an attacker must hold valid (but not administrator-level) credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P) conveys a network-exploitable, low-complexity flaw requiring only low-privilege access with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged access to the camera's web management interface - obtained via default credentials, brute force, or credential reuse - sends a crafted HTTP POST request to a configuration endpoint (such as DDNS or FTP settings) containing an excessively long field value. The alphapd daemon copies this input into a fixed-size stack buffer in the corresponding handler function (e.g., SystemDDNSChanged), overwriting the saved return address and redirecting execution to attacker-controlled shellcode or a ROP chain, achieving arbitrary code execution on the device. … |
| Remediation | No vendor-released patch has been identified in the available data; organizations should check TRENDnet's firmware support pages directly for TV-IP751WIC updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an asset discovery of all TRENDnet TV-IP751WIC cameras connected to your network and immediately segregate them to an isolated VLAN with no internet routing or cross-VLAN access to critical systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today