Description

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-18T13:17:43.287Z",
  "pubdate": "2026-08-18T13:17:43.287Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TRENDnet TEW-WLC100P wireless controller running firmware version 12.07b01. The flaw resides within the DHCP blobmsg Handler component, specifically within the handling logic processed by the binary /sbin/netifd.\nThis vulnerability allows a locally network-positioned adversary to execute arbitrary code or trigger a denial of service condition by sending specially crafted input to the vulnerable handler. Successful exploitation compromises the integrity and availability of the affected device.\nThe attack vector requires local network access to reach the vulnerable service component. Public disclosure of an exploit increases the urgency for defensive posture adjustments, as the barrier to exploitation is significantly lowered for threat actors positioned on the internal network segment.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe handling of data within the DHCP blobmsg Handler component implemented inside the /sbin/netifd binary.\nThe root cause involves the lack of adequate bounds checking when parsing incoming DHCP-related blobmsg structures. When the application receives malformed or excessively long inputs via the affected functionality, the data is copied into a fixed-size stack buffer without verifying the input length.\nThe attack flow proceeds as follows: First, an attacker with access to the local network crafts a malicious payload encapsulated within DHCP traffic or related blobmsg parameters designed to exceed the memory allocation limits of the target buffer. Second, the attacker transmits this payload to the TRENDnet TEW-WLC100P device. Third, the /sbin/netifd process receives and attempts to process the input within the DHCP blobmsg Handler. Fourth, the insecure copy operation overflows the stack, overwriting adjacent memory structures, including saved frame pointers and return addresses.\nBy carefully constructing the payload, an attacker can hijack the execution flow of the binary, potentially achieving remote code execution under the privileges of the running process. The affected product is the TRENDnet TEW-WLC100P with firmware version 12.07b01. Exploitation requires network adjacency to the target device, specifically the ability to communicate with the network interface daemon handling DHCP blobmsg operations."
}