Description

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T21:17:38.857Z",
  "pubdate": "2026-08-19T21:17:38.857Z",
  "executiveSummary": "A critical security flaw has been identified in the TRENDnet TV-IP751WIC IP camera running firmware version 11.03.03. The vulnerability is classified as a stack-based buffer overflow, manifesting within the alphapd web server component specifically through the /cgi-bin/admin/set_time.cgi endpoint.\nThe primary impact of this vulnerability is potential remote code execution, system instability, or complete denial of service of the affected device. Successful exploitation allows a remote attacker to overwrite memory structures on the stack by supplying maliciously crafted input via the Currenttime argument.\nGiven that public exploit code has been released, the risk implications are severe, enabling opportunistic or targeted attacks against exposed devices without requiring prior authentication depending on the interface configuration. Attackers can launch these exploits entirely over the network, making internet-connected cameras primary targets for compromise.\nMitigation requires restricting network exposure, applying vendor patches if available, or disabling vulnerable services until hardening measures can be effectively implemented.",
  "technicalDetails": "The vulnerability resides in the alphapd web server component of the TRENDnet TV-IP751WIC firmware version 11.03.03, specifically within the Common Gateway Interface (CGI) binary mapped to /cgi-bin/admin/set_time.cgi.\nThe root cause of the vulnerability is improper bounds checking on user-supplied input passed via the HTTP request parameter Currenttime. When the alphapd component processes the time configuration request, it copies the contents of the Currenttime argument into a fixed-size stack buffer without adequately verifying the input length.\nAn unauthenticated or authenticated remote attacker can exploit this weakness by transmitting a specially crafted HTTP GET or POST request containing an excessively long string within the Currenttime parameter. The excessive data overflows the boundaries of the allocated stack buffer, resulting in the corruption of adjacent stack memory, including saved frame pointers and return addresses.\nUpon function return, the instruction pointer is redirected to attacker-controlled memory locations if a specific payload structure is supplied, facilitating arbitrary code execution under the privileges of the web server daemon. Due to the network-exposed nature of the alphapd component, the attack surface is readily accessible via standard network protocols over HTTP.\nThe post-exploitation impact includes complete system compromise, unauthorized surveillance access, persistent backdoor installation, or device bricking through repeated denial-of-service conditions."
}