CVE-2026-77946: TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function ucisafeget of the file /cgi-bin/applytime.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enableserver/cameo.time.timezone/cameo.cameo.syslogserver can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Public exploit disclosure means attackers may be able to use available exploit information.
Which inputs are implicated in the vulnerable handler?
The affected apply_time.cgi handler processes the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server arguments. Manipulating these arguments can trigger the stack-based buffer overflow in uci_safe_get.
Which device version is identified as affected?
TRENDnet TEW-821DAP version 2.2.01b05 is identified as affected. The provided information does not establish whether earlier or later versions are affected.