SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-75976 2026-08-18

TRENDnet TEW-823DRU Stack Overflow in wan.cgi (CVE-2026-75976)

"A public proof-of-concept exists for a remotely triggerable stack-based buffer overflow in the TRENDnet TEW-823DRU router's WAN configuration CGI, scored 9.9 CRITICAL by the reporting CNA."

A public proof-of-concept exists for a remotely triggerable stack-based buffer overflow in the TRENDnet TEW-823DRU router's WAN configuration CGI, scored 9.9 CRITICAL by the reporting CNA.

What Is It

CVE-2026-75976 is a stack-based buffer overflow (CWE-121, CWE-119) in TRENDnet TEW-823DRU firmware 1.1.02b01. The flaw sits in a strcpy call in /cgi-bin/wan.cgi, part of the device's NVRAM component. An attacker who controls the wan_l2tp_password argument can overflow the destination stack buffer. The attack can be initiated remotely, and per the NVD record, the exploit has been made available to the public.

Why It Matters

VulDB assigns a CVSS 3.1 base score of 9.9 (CRITICAL) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, and only low privileges required. The scope-changed rating with high confidentiality, integrity, and availability impact reflects that a successful overflow in an embedded router CGI reaches beyond the vulnerable component itself. The CVSS 4.0 assessment scores it 8.6 HIGH and explicitly marks exploit maturity as PROOF_OF_CONCEPT, consistent with the PoC script published on GitHub.

The risk driver is working exploit code, published and reachable over the network, against consumer hardware that sits at the edge of the network by design. This CVE does not appear in the supplied CISA KEV data, so no KEV-mandated remediation deadline applies.

What's Vulnerable

The record lists only 1.1.02b01 as affected; no other firmware versions are enumerated in the supplied data.

Patch Status

No patch, fixed version, vendor advisory, or mitigation guidance is present in the supplied NVD record. The CVE carries a vulnerability status of "Received," meaning NVD enrichment was still pending as of this writing. No CISA-required action applies, as there is no KEV entry. Operators running TEW-823DRU 1.1.02b01 should treat remote management exposure as the primary attack surface until vendor guidance appears.

Sources