Description

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-22T11:16:54.447Z",
  "pubdate": "2026-08-22T11:16:54.447Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the TRENDnet TEW-821DAP router running firmware version 2.2.01b05. The flaw resides within the NTP Timezone Configuration Handler, specifically inside the /cgi-bin/apply_time.cgi binary via the vulnerable function uci_safe_get. This vulnerability allows remote, unauthenticated attackers to trigger a memory corruption condition by supplying maliciously crafted input parameters.\nThe impact of successful exploitation includes remote code execution, potential system compromise, and denial of service conditions by disrupting the underlying OpenWrt Unified Configuration Interface (UCI) backend. Because the attack vector is exposed over the network, malicious actors can exploit the vulnerability without prior access or credentials to the administrative interface.\nGiven that public exploits are available, the risk to unpatched systems is critical. Remediation requires applying vendor-supplied firmware updates or restricting administrative access interfaces to trusted local networks until a permanent patch is deployed.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow caused by unsafe handling of user-supplied input within the uci_safe_get function located in /cgi-bin/apply_time.cgi. This component is responsible for managing the NTP Timezone Configuration Handler of the targeted device.\nDuring the processing of HTTP requests sent to the CGI binary, input parameters associated with system configuration are retrieved and processed. Specifically, the arguments vulnerable to manipulation include system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server. The underlying code fails to perform adequate boundary checks and length validation on these parameters before copying them into static stack-based buffers.\nAn attacker can exploit this vulnerability by crafting a malicious HTTP request containing an overly long payload directed at the vulnerable arguments within /cgi-bin/apply_time.cgi. When the uci_safe_get function processes the excessively large string, it overflows the destination buffer on the stack. This overflows adjacent memory regions, overwriting critical execution data such as the saved frame pointer and the return address.\nUpon function return, the CPU attempts to jump to the attacker-controlled memory address specified by the overwritten return pointer. This allows the execution of arbitrary shellcode or Return-Oriented Programming (ROP) chains depending on the memory protections present in the firmware build, such as non-executable stack implementations.\nThe attack flow requires network connectivity to the management interface of the TRENDnet TEW-821DAP version 2.2.01b05. The attack can be launched entirely remotely over the network, and the lack of required authentication or privilege levels significantly lowers the attack complexity. Successful exploitation leads to immediate compromise of the daemon or full system execution privileges, potentially resulting in persistent device takeover."
}