SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-77946 2026-08-22

CVE-2026-77946: Critical Stack Overflow in TRENDnet TEW-821DAP NTP Handler

"An unauthenticated, remotely exploitable stack-based buffer overflow in the TRENDnet TEW-821DAP access point's NTP timezone configuration handler carries a CVSS 3.1 base score of 10.0, and public exploit details are…"

An unauthenticated, remotely exploitable stack-based buffer overflow in the TRENDnet TEW-821DAP access point's NTP timezone configuration handler carries a CVSS 3.1 base score of 10.0, and public exploit details are already circulating.

What Is It

The flaw lives in the uci_safe_get function within /cgi-bin/apply_time.cgi, part of the device's NTP Timezone Configuration Handler. Manipulating the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server arguments triggers a stack-based buffer overflow. The CVE record maps the weakness to CWE-119 (improper restriction of operations within memory buffer bounds) and CWE-121 (stack-based buffer overflow), both assigned by the VulDB CNA at submission time, not by NVD analysts, since the record has not yet been through NVD analysis. The attack can be launched remotely, and per the CVE record, the exploit has been publicly disclosed and may be utilized.

Why It Matters

The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, scores a perfect 10.0 CRITICAL. No authentication, no user interaction, low attack complexity, network reachable, and a changed scope with total loss of confidentiality, integrity, and availability. CVSS 4.0 rates it 9.3 CRITICAL with an exploit maturity of PROOF_OF_CONCEPT, meaning working exploit code or a detailed writeup exists in the public domain. The legacy CVSSv2 score is also 10.0 with complete C/I/A impact. All three scores are CNA-supplied and carry the usual caveat that unanalyzed CNA severity data can shift once NVD completes its own assessment.

This CVE does not appear in the CISA KEV catalog based on the supplied data, so there is no confirmation of active in-the-wild exploitation and no federal remediation deadline attached. Public disclosure of a network-reachable, pre-auth memory corruption bug on an embedded device still shortens the window considerably.

What's Vulnerable

Patch Status

The supplied NVD record lists no vendor patch, fixed version, or remediation guidance. Vulnerability status is Received, published 2026-08-22 by the VulDB CNA and not yet analyzed; so every enrichment field above, including the CWE mappings and severity scores, reflects the CNA submission rather than NVD's own analysis. No required action is specified. Until a fix is published, restricting network access to the device's management interface is the only lever the source material supports.

Sources