Tew 755Ap
Monthly
Stack-based buffer overflow in TRENDnet TEW-755AP firmware (up to build 20260702) allows remote low-privileged attackers to corrupt stack memory via the cameo.wan.wan_pppoe_password_00 parameter in /cgi-bin/wan.cgi. A public proof-of-concept exploit script is confirmed on GitHub, materially lowering the bar for exploitation. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability on both the device and downstream network systems, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Stack-based buffer overflow in TRENDnet TEW-755AP firmware (versions up to 20260702) allows remote low-privileged attackers to corrupt the stack in the /sbin/mycli binary by supplying an oversized ssid argument to function FUN_401000, potentially enabling arbitrary code execution on the device. A public Python proof-of-concept (poc-mycli-overflow.py) is available on GitHub, materially elevating practical risk beyond the theoretical score. No vendor-released patch has been identified at time of analysis, leaving affected devices without an official remediation path.
Stack-based buffer overflow in TRENDnet TEW-755AP firmware (up to build 20260702) allows remote low-privileged attackers to corrupt stack memory via the cameo.wan.wan_pppoe_password_00 parameter in /cgi-bin/wan.cgi. A public proof-of-concept exploit script is confirmed on GitHub, materially lowering the bar for exploitation. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability on both the device and downstream network systems, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Stack-based buffer overflow in TRENDnet TEW-755AP firmware (versions up to 20260702) allows remote low-privileged attackers to corrupt the stack in the /sbin/mycli binary by supplying an oversized ssid argument to function FUN_401000, potentially enabling arbitrary code execution on the device. A public Python proof-of-concept (poc-mycli-overflow.py) is available on GitHub, materially elevating practical risk beyond the theoretical score. No vendor-released patch has been identified at time of analysis, leaving affected devices without an official remediation path.