CVE-2026-77946: Stack-based Buffer Overflow in TRENDnet TEW-821DAP

The vulnerability CVE-2026-77946 affects TRENDnet TEW-821DAP version 2.2.01b05. It is a stack-based buffer overflow in the uci_safe_get function of the /cgi-bin/apply_time.cgi script, which handles NTP Timezone Configuration. Manipulating the arguments system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server can cause a stack-based buffer overflow. The vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code or cause a denial of service on the affected device. Given the critical CVSS score of 10, the impact includes full compromise of the device's confidentiality, integrity, and availability. The vulnerability can be triggered remotely without authentication, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces to trusted users only and monitor for any suspicious activity related to NTP configuration requests. Avoid exposing the device's web management interface to untrusted networks.