SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-75783 2026-08-18

CVE-2026-75783: Stack Overflow in TRENDnet TEW-WLC100P netifd DHCP Handler

"A publicly disclosed stack-based buffer overflow in the TRENDnet TEW-WLC100P wireless controller's `/sbin/netifd` DHCP blobmsg handler is scored as allowing an unauthenticated attacker on the local network to fully…"

A publicly disclosed stack-based buffer overflow in the TRENDnet TEW-WLC100P wireless controller's /sbin/netifd DHCP blobmsg handler is scored as allowing an unauthenticated attacker on the local network to fully compromise the device. That severity rating reflects the CNA's assessment rather than a demonstrated end-to-end compromise; the published proof-of-concept establishes the overflow, and reliable code execution from it has not been independently confirmed in the source material.

What Is It

The vulnerability affects an unknown function in the file /sbin/netifd within the DHCP blobmsg Handler component of TRENDnet TEW-WLC100P firmware 12.07b01. Manipulation of that handler leads to a stack-based buffer overflow (CWE-121, CWE-119). The attack must be carried out from within the local network. Proof-of-concept exploit code has been publicly disclosed and may be used.

Why It Matters

NVD's CVSS v3.1 score from the CNA is 9.6 (CRITICAL), with a scope change and complete loss of confidentiality, integrity, and availability. No authentication and no user interaction are required. The associated vector, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, is composed entirely of CVSS v3.1 metrics (the scope metric S does not exist in v4.0), but the source record prefixes it CVSS:4.0/. Treat that prefix as a data-entry artifact: the string is a v3.1 vector matching the v3.1 score. Separately, the CVSS v4.0 assessment scores the issue 8.6 (HIGH) with exploit maturity rated Proof-of-Concept, and CISA's SSVC decision point records exploitation as poc, automatable yes, and technical impact total.

There is no CISA KEV entry for this CVE, the KEV record supplied is empty, so active in-the-wild exploitation is not confirmed. However, working PoC code is already published on GitHub, which meaningfully shortens the runway between disclosure and opportunistic use against reachable LAN segments.

What's Vulnerable

Because the attack vector is adjacent (local network), exposure is limited to attackers with a foothold on the same broadcast domain; including any compromised endpoint, guest VLAN, or wireless client that can reach the controller.

Patch Status

The supplied NVD record contains no vendor advisory, patch reference, or fix version. The CVE was published 2026-08-18 with a status of Received, meaning NVD analysis is not yet complete. No required remediation action is specified in the source material. Restrict network access to the controller's management and DHCP interfaces pending vendor guidance.

Sources