A published proof-of-concept exploit targets a remotely reachable stack-based buffer overflow in the alphapd web server of the TRENDnet TV-IP751WIC IP camera, rated CVSS 9.9 (CRITICAL).
What Is It
VulDB reports a flaw in TRENDnet TV-IP751WIC firmware 11.03.03 affecting the alphapd component. The vulnerability spans several handler functions, SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, and the unnamed routines FUN_00432574 and FUN_0043372C. Manipulating input to these functions triggers a stack-based buffer overflow. The weakness is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow). The attack can be launched remotely, and the exploit has been published and may be used.
Why It Matters
The CVSS 3.1 base score is 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), network attack vector, low complexity, only low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 assessment scores 8.6 HIGH with exploit maturity marked PROOF_OF_CONCEPT, reflecting the publicly available PoC code. The reference set includes a proof-of-concept script hosted on GitHub, so the barrier to attempting exploitation is likely minimal.
There is no CISA KEV entry for this CVE in the supplied data, so active in-the-wild exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: TRENDnet
- Product: TV-IP751WIC
- Affected version: 11.03.03 (status: affected)
- Component/module:
alphapd - CPE:
cpe:2.3:a:trendnet:tv-ip751wic:*:*:*:*:*:*:*:*
Patch Status
The supplied source material lists no vendor advisory, patch, fixed version, or mitigation guidance. The NVD record was published 2026-08-18 with a status of "Received," meaning it has not yet completed NVD analysis. No required-action or remediation deadline is specified, as the CVE does not appear in the KEV data provided.
Sources
- NVD, CVE-2026-75877 record (source identifier: [email protected])
- VulDB, CVE entry: https://vuldb.com/cve/CVE-2026-75877
- VulDB, vulnerability detail: https://vuldb.com/vuln/391571
- VulDB, threat intelligence: https://vuldb.com/vuln/391571/cti
- VulDB, submission record: https://vuldb.com/submit/877795
- GitHub (meishigana/CVE), PoC directory: https://github.com/meishigana/CVE/tree/main/team15_20260702/09_751wic-apd-password-overflow
- GitHub (meishigana/CVE), PoC script: https://github.com/meishigana/CVE/blob/main/team15_20260702/09_751wic-apd-password-overflow/poc/poc-password-overflow.py