TRENDnet TEW-755AP EUVD-2026-62973

Exploitation requires low-privilege authenticated access to the device's HTTP web management interface - the CVSS 4.0 PR:L metric explicitly confirms that at least low-level credentials are needed; unauthenticated exploitation is not supported by the available data. The vulnerable parameter (cameo.wan.wan_pppoe_password_00) is accessed through the WAN configuration CGI handler, meaning the management interface must be reachable from the attacker's network position, either on the local management network or via an exposed WAN-side remote management interface. Exploitation is limited by the credential requirement and by the need to reach the CGI endpoint; organizations that disable remote management and restrict the management interface to isolated internal segments are not exposed from external networks. No special non-default configuration beyond having the device deployed is implied.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) establishes this as a low-complexity, network-reachable flaw requiring only low-privilege authentication with no user interaction - a high-priority combination. The E:P exploit maturity modifier in the provided vector is corroborated by a confirmed public PoC on GitHub (poc-ssi-overflow.py), which substantially reduces exploitation effort. All six impact metrics are rated High (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), reflecting that full device compromise is plausible and, given this is a network access point, downstream network impact is realistic. No CISA KEV listing is present, so confirmed active exploitation cannot be asserted - the distinction between a public PoC and confirmed widespread exploitation is meaningful for triage. EPSS data was not supplied; given the public PoC and network vector, exploitation probability should be considered elevated. The absence of a vendor patch at time of analysis makes compensating controls the only available mitigation, elevating urgency. This is a genuine operational priority - not a paper-risk CVSS inflation - and any organization running unpatched TEW-755AP units with management interfaces reachable from untrusted networks faces meaningful exposure.

An attacker with low-privilege credentials to the TEW-755AP's web management interface sends a crafted HTTP POST request to /cgi-bin/wan.cgi, embedding an oversized string in the cameo.wan.wan_pppoe_password_00 parameter. The ssi CGI handler copies this value into a fixed stack buffer without bounds checking, overwriting the return address and redirecting execution flow. The publicly available poc-ssi-overflow.py script on GitHub (https://github.com/meishigana/CVE/blob/main/team15_20260702/15_755ap-ssi-bof/poc/poc-ssi-overflow.py) demonstrates this technique, potentially enabling arbitrary code execution under the firmware process's privilege context.