Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77946: TRENDnet TEW-821DAP router can be remotely crashed via time settings

CVE-2026-77946 · published 12 days ago

Summary

The router’s time‑zone configuration page can be tricked into overflowing its memory, which could let an attacker cause the device to stop working or take control. This can be done from outside the network without special access. Apply the latest firmware update from TRENDnet or disable remote time‑zone changes until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
trendnet	tew-821dap	2.2.01b05

Original advisory text

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

References

https://vuldb.com/vuln/394175 vdb-entry technical-description
https://vuldb.com/vuln/394175/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-77946 third-party-advisory
https://vuldb.com/submit/881252 third-party-advisory
https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/... exploit

Severity

9.3 Critical

CVSS 3.1: 10.0 (MITRE)

Exploitation

EPSS <1%

Type

CWE-121Stack-based Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published22 Aug 2026

Updated3 Sep 2026

First seen22 Aug 2026

Sources

CVE-2026-77946 · NVD

CVE-2026-77946 · MITRE

Monitor software like this

Free during beta