TRENDnet TEW-821DAP EUVD-2026-64247

Exploitation requires the ability to send an HTTP request to the /cgi-bin/apply_time.cgi endpoint (NTP Timezone Configuration Handler) on a TEW-821DAP running 2.2.01b05, and control over at least one of the specific parameters system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server with an over-length value. The CVSS vector asserts PR:N/UI:N (no authentication or user interaction), but because this is an administrative configuration handler, a realistic limiting factor is whether the management UI enforces a login and whether it is reachable from the attacker's network - authentication requirements are not independently confirmed from the available data and should be verified on the device. Practical exploitation is further limited to deployments where the web interface is network-reachable to the attacker (exposure to untrusted networks dramatically raises risk; LAN-only exposure lowers it).

The raw CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with High vulnerable- AND subsequent-system impact) presents this as a trivial, unauthenticated, remotely exploitable full-compromise flaw, and a public PoC (E:P) increases opportunistic risk. However, several signals warrant tempering: this record originates from VulDB (a source that frequently rates SOHO device CGI flaws as PR:N even when the management interface realistically requires authentication or LAN adjacency), the endpoint is an administrative configuration handler typically gated behind a login, and there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation - only proof-of-concept code. The subsequent-system High metrics (SC:H/SI:H/SA:H) that inflate the score are questionable, since compromising the AP itself does not inherently constitute a scope change to a separate system. Net assessment: a genuinely serious memory-corruption bug on an exposed device, but its practical severity hinges on whether the web UI is reachable and unauthenticated; if the management interface is exposed to untrusted networks it should be treated as urgent, whereas LAN-only, authenticated-only deployments face materially lower real-world risk. The 'network vector, no auth' claim should be verified against the device's actual authentication behavior before treating it as wormable.

An attacker who can reach the TEW-821DAP web-management interface sends a crafted POST to /cgi-bin/apply_time.cgi with an over-length system.ntp.server (or syslog_server/time_zone) value; the oversized string overflows a fixed stack buffer in uci_safe_get, overwriting the return address and either crashing the device (DoS) or redirecting execution to attacker-supplied shellcode. Public proof-of-concept material for this exact endpoint has been disclosed, lowering the effort required; the low attack complexity means a working exploit could be adapted quickly, though reliable code execution on the embedded MIPS/ARM target typically requires defeating any device-specific memory protections.