Skip to main content

TRENDnet TEW-821DAP EUVDEUVD-2026-64247

| CVE-2026-77946 CRITICAL
Stack-based Buffer Overflow (CWE-121)
2026-08-22 VulDB GHSA-cvhx-h689-9gjx
Stack Overflow Buffer Overflow Tew 821Dap
9.3
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable config CGI with low complexity, but as an administrative handler it realistically requires some auth (PR:L); memory corruption yields full C/I/A impact with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 22, 2026 - 11:30 vuln.today
CVSS changed
Aug 22, 2026 - 11:22 NVD
10.0 (CRITICAL) 9.3 (CRITICAL)
CVE Published
Aug 22, 2026 - 11:00 cve.org
CRITICAL 9.3

DescriptionCVE.org

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach device web interface
Delivery
Send crafted POST to apply_time.cgi
Exploit
Overflow stack via oversized NTP/syslog parameter
Execution
Overwrite saved return address in uci_safe_get
Persist
Execute code or crash access point
Impact
Gain control of AP
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the ability to send an HTTP request to the /cgi-bin/apply_time.cgi endpoint (NTP Timezone Configuration Handler) on a TEW-821DAP running 2.2.01b05, and control over at least one of the specific parameters system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server with an over-length value. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The raw CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with High vulnerable- AND subsequent-system impact) presents this as a trivial, unauthenticated, remotely exploitable full-compromise flaw, and a public PoC (E:P) increases opportunistic risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the TEW-821DAP web-management interface sends a crafted POST to /cgi-bin/apply_time.cgi with an over-length system.ntp.server (or syslog_server/time_zone) value; the oversized string overflows a fixed stack buffer in uci_safe_get, overwriting the return address and either crashing the device (DoS) or redirecting execution to attacker-supplied shellcode. Public proof-of-concept material for this exact endpoint has been disclosed, lowering the effort required; the low attack complexity means a working exploit could be adapted quickly, though reliable code execution on the embedded MIPS/ARM target typically requires defeating any device-specific memory protections.
Remediation No vendor-released patch is identified at time of analysis, and no fixed firmware version is available in the provided data, so upgrade guidance cannot cite a specific build - monitor TRENDnet's support/security pages for a TEW-821DAP firmware update superseding 2.2.01b05. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all TEW-821DAP devices running firmware 2.2.01b05 and prioritize those with internet or untrusted network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tew 821Dap

View all
CVE-2026-15484 HIGH
8.7 Jul 12

Buffer overflow in the TRENDnet TEW-821DAP (firmware 1.12B01) wireless access point lets an authenticated remote attacke
CVE-2026-15483 HIGH
8.7 Jul 12

Buffer overflow in the TRENDnet TEW-821DAP (v1.0R, firmware 1.12B01) dual-band access point lets an authenticated remote
CVE-2026-7607 HIGH
8.7 May 02

Remote authenticated attackers can execute arbitrary code on TRENDnet TEW-821DAP v1.xR hardware running firmware 1.12B01
CVE-2026-77945 LOW POC
2.1 Aug 22

Command injection in TRENDnet TEW-821DAP 2.2.01b05 allows remote low-privileged attackers to execute arbitrary OS comman
CVE-2026-76582 LOW POC
2.1 Aug 19

Command injection in TRENDnet TEW-821DAP firmware 2.2.01b05 allows authenticated remote attackers to execute arbitrary O
CVE-2026-7611 MEDIUM
6.3 May 02

Insufficient verification of firmware authenticity in TRENDnet TEW-821DAP up to version 1.12B01 allows remote attackers

CVE-2026-7606 MEDIUM
6.3 May 02

Insufficient verification of data authenticity in the firmware update handler of TRENDnet TEW-821DAP 1.12B01 allows remo
CVE-2026-7609 LOW POC
2.1 May 02

OS command injection in TRENDnet TEW-821DAP firmware up to version 1.12B01 allows authenticated remote attackers to exec
CVE-2026-7608 LOW POC
2.0 May 02

OS command injection in TRENDnet TEW-821DAP up to firmware version 1.12B01 allows authenticated local attackers to execu
CVE-2026-15486 MEDIUM
5.3 Jul 12

OS command injection in TRENDnet TEW-821DAP firmware 1.11B03 allows a network-adjacent authenticated attacker to execute
CVE-2026-15485 MEDIUM
5.3 Jul 12

OS command injection in the TRENDnet TEW-821DAP 1.11B03 wireless access point allows authenticated remote attackers to e
CVE-2026-7610 LOW
2.9 May 02

TRENDnet TEW-821DAP firmware version 1.12B01 transmits sensitive information in cleartext via the /www/cgi/ssi endpoint

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Share

EUVD-2026-64247 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy