A stack-based buffer overflow vulnerability (CVE-2026-75976) affects TRENDnet TEW-823DRU version 1.1.02b01. The issue arises from improper handling of the wan_l2tp_password parameter in the strcpy function of the /cgi-bin/wan.cgi script, part of the NVRAM component. This flaw can be exploited remotely without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause denial of service. Exploit code has been publicly disclosed. The CVSS 4.0 base score is 9.4, reflecting critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high scope and impact metrics. No patch or vendor advisory is referenced in the provided data.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. Given the public availability of exploit code and the critical CVSS score, the risk of exploitation is significant. The vulnerability requires no user interaction and can be triggered remotely, increasing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces and monitor for suspicious activity related to the wan_l2tp_password parameter. Avoid exposing the device directly to untrusted networks.