Tv Ip751Wic
Monthly
Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. A public proof-of-concept exploit script is confirmed available on GitHub, though this vulnerability is not currently listed in the CISA KEV catalog.
Command injection in TRENDnet TV-IP751WIC firmware 11.03.03 enables remote authenticated attackers to execute arbitrary OS commands through the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The flaw stems from unsanitized user input passed directly to a shell command in the time-setting CGI handler. A public proof-of-concept exploit (poc-time-injection.py) is confirmed available on GitHub, lowering the barrier to exploitation significantly; no CISA KEV listing has been issued at time of analysis.
Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. A public proof-of-concept exploit script is confirmed available on GitHub, though this vulnerability is not currently listed in the CISA KEV catalog.
Command injection in TRENDnet TV-IP751WIC firmware 11.03.03 enables remote authenticated attackers to execute arbitrary OS commands through the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The flaw stems from unsanitized user input passed directly to a shell command in the time-setting CGI handler. A public proof-of-concept exploit (poc-time-injection.py) is confirmed available on GitHub, lowering the barrier to exploitation significantly; no CISA KEV listing has been issued at time of analysis.