Description

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-18T15:17:13.857Z",
  "pubdate": "2026-08-18T15:17:13.857Z",
  "executiveSummary": "A critical vulnerability has been identified in the TRENDnet TEW-WLC100 wireless controller running version 1v2.07b01. Specifically, the flaw exists within the HTTP Header Handler component, residing in the binary /usr/nginx/sbin/nginx inside the function FUN_0040da4c. The vulnerability is classified as a stack-based buffer overflow, triggered by the improper handling and parsing of the Server argument. An unauthenticated remote attacker can exploit this weakness to cause a denial of service or potentially achieve remote code execution on the underlying operating system. The attack vector is fully network-accessible, and because exploit code has been made publicly available, the risk of active exploitation in the wild is significantly elevated. Compromise of the affected device could allow an adversary to gain unauthorized administrative control over the network infrastructure device, leading to severe confidentiality, integrity, and availability breaches within the managed local area network.",
  "technicalDetails": "The vulnerability resides in the HTTP Header Handler component of the TRENDnet TEW-WLC100 1v2.07b01 firmware, specifically inside the NGINX binary located at /usr/nginx/sbin/nginx. During the execution of the vulnerable function FUN_0040da4c, incoming HTTP headers are processed without adequate bounds checking on the length of the Server argument. When a malicious HTTP request containing an excessively long Server header is parsed, the input data exceeds the allocated boundaries of the stack-based buffer.\nThe root cause is a classic memory corruption vulnerability stemming from unsafe string copy operations or memory manipulation routines within FUN_0040da4c that fail to validate input length prior to writing data to the stack. As a result, the excess input overflows the stack frame, overwriting adjacent memory regions, which can include saved frame pointers and return addresses.\nThe attack flow proceeds as follows: 1) The remote attacker crafts a malicious HTTP request containing a specially engineered payload within the Server header. 2) The attacker transmits this packet over the network to the HTTP service managed by the NGINX binary on the target device. 3) The network daemon receives the request and passes it to the HTTP Header Handler component. 4) The execution flow enters the vulnerable function FUN_0040da4c, where the unbounded input is copied into a fixed-size stack buffer. 5) The stack buffer overflows, corrupting critical control data. 6) Upon function return, the instruction pointer is redirected to attacker-controlled memory if shellcode injection is achieved, or the process crashes, resulting in a denial of service.\nThe vulnerability requires network connectivity to the targeted device's HTTP interface, typically exposed on standard web management ports. No prior authentication or elevated privileges are required to launch the attack, lowering the barrier to entry for malicious actors. Post-exploitation impact includes complete system compromise, arbitrary command execution with the privileges of the NGINX process, and potential persistence on the embedded system."
}