CVE-2026-77946: Stack-based Buffer Overflow in TRENDnet TEW-821DAP

The TRENDnet TEW-821DAP device running firmware version 2.2.01b05 contains a stack-based buffer overflow vulnerability in the uci_safe_get function of the /cgi-bin/apply_time.cgi script, specifically in the NTP Timezone Configuration Handler component. This vulnerability arises from improper handling of the arguments system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server, allowing an attacker to remotely trigger a buffer overflow condition. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. The CVSS 3.1 vector indicates it is network exploitable with low attack complexity, no privileges or user interaction required, and results in complete compromise of confidentiality, integrity, and availability. No patch or vendor advisory has been provided to date.

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the affected device, potentially leading to full system compromise. The critical CVSS score reflects the ability to impact confidentiality, integrity, and availability with no required privileges or user interaction. This could result in unauthorized control over the device and disruption of its normal operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces to trusted users only and monitor for any unusual activity related to the NTP Timezone Configuration Handler. Avoid exposing the device to untrusted networks.