CVE-2026-15483

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05 in the uci_safe_get function of /cgi-bin/apply_time.cgi in the NTP Timezone Configuration Handler. Manipulating the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server arguments leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

A flaw was found in TRENDnet TEW-821DAP up to 1.12B01 in the tools_diagnostic function of /tmp/diagnostic (Firmware Update component). Manipulation causes OS command injection, remotely exploitable. The exploit is public; the product was EOL 8 years ago and is unsupported.

A vulnerability was detected in TRENDnet TEW-821DAP up to version 1.12B01 in the tools_diagnostic function, allowing OS command injection. The exploit is publicly available and may be used. The vendor states the product was EOL 8 years ago and is no longer supported.

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05 in an unknown function of /cgi-bin/upload.cgi in the ssi component. Manipulating the filename argument results in command injection. The attack can be initiated remotely, and the exploit has been made public.

In TRENDnet TEW-821DAP version 2.2.01b05, a command injection vulnerability exists in the popen/system function of the file /cgi-bin/ping.cgi in the ssi component. Manipulating the ipaddr argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in TRENDnet TEW-821DAP version 1.11B03, affecting the function sub_41FBD0 in the file /goform/system_ntp. Remote manipulation of the Hostname argument allows OS command injection. The vendor states the device is end-of-life (EOL) and will not receive patches.

A vulnerability was found in TRENDnet TEW-821DAP firmware version 1.11B03, allowing OS command injection via the hostname, username, and password parameters in the /goform/tools_ddns file. The attack can be performed remotely, and the vendor states the device is end-of-life (EOL).

A flaw in TRENDnet TEW-821DAP version 1.11B03 allows OS command injection via the sub_43F2C4 function in /goform/tools_nslookup. The attack is remotely exploitable by manipulating the nslookup_target or dns_server arguments. The vendor states the device is end-of-life (EOL) and will not receive patches.

A buffer overflow vulnerability was found in the TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. The attack can be launched remotely. The vendor states the device is End-of-Life (EOL) and will not be patched.

A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01 in the platform_do_upgrade_cameo_dev function of cameo_dev.sh within the Firmware Update Handler. Manipulation leads to insufficient verification of data authenticity. The attack is remotely possible but highly complex and difficult to exploit.