Description

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T22:17:27.447Z",
  "pubdate": "2026-08-19T22:17:27.447Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in TRENDnet TEW-755AP devices up to version 20260702. The flaw resides within the FUN_401000 function located in the /sbin/mycli binary. The vulnerability is triggered via the manipulation of the ssid argument during processing. This security defect allows remote attackers to execute arbitrary code or cause a denial of service against the affected router.\nThe impact of successful exploitation includes complete compromise of the affected routing equipment, potential interception of network traffic, and destabilization of core networking services. Given that public exploit material is currently available, the risk profile is elevated. The attack vector is network-accessible, meaning malicious actors can potentially target vulnerable devices without prior physical access, contingent upon administrative service exposure. Remediation requires vendor-supplied firmware updates or strict access control restrictions on vulnerable management interfaces.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory handling operations within the FUN_401000 function of the /sbin/mycli executable on TRENDnet TEW-755AP devices running firmware versions up to 20260702. The root cause lies in the inadequate bounds checking or sanitization of input data supplied via the ssid argument before it is copied into a fixed-size stack buffer.\nExploitation occurs when a remote attacker submits a crafted, excessively long string as the value for the ssid parameter. Because the vulnerable function does not enforce strict length validation during the copy operation, the input exceeds the allocated boundaries of the destination buffer on the stack. This overflow overwrites adjacent stack memory structures, including the saved frame pointer and the return instruction pointer.\nUpon function return, the execution flow is redirected to the memory address specified by the attacker within the overwritten return pointer. This enables arbitrary code execution within the execution context of the /sbin/mycli process, which may operate with elevated system privileges. The network exposure of the service handling the ssid parameter facilitates remote exploitation, allowing attackers to deliver payloads across the network without requiring prior authentication or specific privileges, provided they can reach the vulnerable interface."
}