Description

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T00:16:28.510Z",
  "pubdate": "2026-08-19T00:16:28.510Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TRENDnet TEW-823DRU router running firmware version 1.1.02b01. The weakness specifically resides in the strcpy function located within the /cgi-bin/wan.cgi binary, specifically tied to the NVRAM component when processing the wan_l2tp_password argument. This vulnerability allows remote unauthenticated attackers to corrupt the stack memory by supplying an excessively long payload via the vulnerable parameter. Successful exploitation can lead to arbitrary code execution, system compromise, and full device takeover. Given that exploit code has been made publicly available, the risk to vulnerable deployments is critical, potentially enabling remote attackers to compromise network security boundaries without prior authentication.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory handling within the binary /cgi-bin/wan.cgi. The root cause of the flaw is the utilization of the unsafe string copy function, strcpy, to process input data designated for the NVRAM component. Specifically, the argument wan_l2tp_password accepts user-supplied input via HTTP requests processed by the CGI binary without implementing adequate boundary checks or input length validation.\nDuring the attack flow, a remote attacker crafts a malicious HTTP request targeting the /cgi-bin/wan.cgi endpoint. The request injects an oversized string payload into the wan_l2tp_password parameter. When the application executes the vulnerable strcpy function, it copies the excessively long input into a fixed-size stack buffer allocated for the NVRAM configuration handling. Because the input size exceeds the destination buffer capacity, data overflows the stack boundaries, overwriting adjacent memory structures, including saved frame pointers and return addresses.\nBy carefully structuring the injected payload, an attacker can hijack the execution flow of the binary upon function return, directing it to shellcode included within the payload or leveraging Return-Oriented Programming (ROP) chains. The affected component is the NVRAM management subsystem exposed through the web administrative interface. The vulnerability is accessible remotely over the network, does not require prior authentication or elevated privileges, and poses a severe threat to confidentiality, integrity, and availability of the affected system."
}