Description

A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T21:17:38.643Z",
  "pubdate": "2026-08-19T21:17:38.643Z",
  "executiveSummary": "A command injection vulnerability has been identified in the TRENDnet TV-IP751WIC camera running firmware version 11.03.03. The security flaw resides within the alphapd component, specifically inside the /cgi-bin/admin/set_time.cgi endpoint, which fails to adequately sanitize user-supplied input before processing it. This vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands on the underlying operating system with the privileges of the web server or application daemon.\nThe risk implications are severe, as successful exploitation could lead to complete device compromise, unauthorized remote access, persistence within the local network, and potential pivoting into internal segments. Publicly available exploit code increases the likelihood of opportunistic attacks targeting vulnerable devices exposed to the internet. Exploitation requires network connectivity to the targeted device's HTTP/HTTPS interface, but no prior authentication or administrative privileges are explicitly mandated based on the accessible functionality.\nOrganizations and users utilizing the affected product must address this exposure promptly through network segmentation, edge filtering, or decommissioning unsupported hardware where vendor patches are unavailable.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from insufficient input validation and sanitization within the alphapd HTTP daemon handling requests to the /cgi-bin/admin/set_time.cgi script. In embedded network devices such as IP cameras, CGI binaries often interface directly with system-level utilities or shell environments to configure administrative settings, such as system time, Network Time Protocol (NTP) servers, or timezones.\nThe root cause of the vulnerability lies in the insecure passing of HTTP parameter values directly to system execution functions, such as system(), popen(), or execve(), without stripping or escaping shell metacharacters (e.g., semicolons, backticks, pipe symbols). An attacker can interact with the vulnerable endpoint remotely over the network by sending a maliciously crafted HTTP GET or POST request containing shell commands appended to expected input parameters within /cgi-bin/admin/set_time.cgi.\nThe attack flow proceeds as follows: First, the remote attacker identifies an exposed instance of the TRENDnet TV-IP751WIC running firmware version 11.03.03. Second, the attacker crafts an exploit payload designed to inject operating system commands through the time-setting functionality managed by alphapd. Third, the HTTP request is transmitted across the network to the target device without requiring valid session credentials or authentication tokens. Fourth, the alphapd binary receives the malicious input, processes the parameters, and improperly passes them to the underlying shell. Finally, the injected commands are executed by the operating system, granting the attacker arbitrary code execution capabilities.\nThe post-exploitation impact includes full system compromise of the affected camera, potential denial of service, interception of video or audio streams, and utilization of the compromised device as a foothold for lateral movement inside the local area network. Since a public exploit is available, threat actors can automate the discovery and compromise of unpatched devices exposed via public search engines or direct scanning."
}