This vulnerability affects TRENDnet TEW-821DAP version 2.2.01b05 in the uci_safe_get function of the /cgi-bin/apply_time.cgi script, which handles NTP Timezone Configuration. By remotely manipulating the arguments system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server, an attacker can trigger a stack-based buffer overflow. This could allow execution of arbitrary code or cause denial of service. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but no patch or official fix is documented yet.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device without requiring authentication or user interaction. Given the critical CVSS score and the nature of the buffer overflow, attackers could gain control over the device or disrupt its normal operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity related to NTP configuration requests. No vendor advisory or patch links are currently available.