SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-75784 2026-08-18

CVE-2026-75784: Critical Unauthenticated Stack Overflow in TRENDnet TEW-WLC100

"A stack-based buffer overflow in the nginx binary of TRENDnet's TEW-WLC100 wireless controller can be triggered by a remote, unauthenticated attacker via a crafted HTTP `Server` header, with a reported impact of full…"

A stack-based buffer overflow in the nginx binary of TRENDnet's TEW-WLC100 wireless controller can be triggered by a remote, unauthenticated attacker via a crafted HTTP Server header, with a reported impact of full device compromise.

What Is It

CVE-2026-75784 is a stack-based buffer overflow (CWE-121, CWE-119) in TRENDnet TEW-WLC100 version 1v2.07b01. The flaw sits in function FUN_0040da4c inside /usr/nginx/sbin/nginx, part of the device's HTTP Header Handler component. Manipulation of the Server argument overflows a stack buffer. The attack can be launched remotely, and per the NVD record, "the exploit is now public and may be used."

Why It Matters

The vulnerability carries a CVSS 3.1 base score of 10.0 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, and a changed scope. The CVSS 4.0 assessment scores 9.3 (CRITICAL) with high confidentiality, integrity, and availability impact on the vulnerable system, and rates exploit maturity as Proof-of-Concept. Note that a 9.3 is not consistent with high impact metrics on subsequent systems as well, that combination would score higher, so the CVSS 4.0 rating should not be read as establishing downstream system impact. CVSS 2.0 scores it 10.0 with complete C/I/A impact.

The CVSS 3.1 scope change still matters here: a wireless LAN controller sits upstream of the access points and clients it manages, so a compromise of the controller has plausible reach beyond the controller itself, even though the scoring data does not quantify that downstream impact.

Proof-of-concept exploit code is reportedly published on GitHub. Its functionality has not been independently verified, but public PoC availability of any quality narrows the gap between disclosure and opportunistic scanning.

What's Vulnerable

Patch Status

The supplied source material contains no CISA KEV entry for this CVE, there is no confirmation of active in-the-wild exploitation, and no KEV remediation deadline or required action. The NVD record was published 2026-08-18 with a status of "Received" and lists no vendor advisory, fixed version, or mitigation guidance. No patch information is available in the source data.

Sources