CVE-2026-76584

Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in TRENDnet TV-IP751WIC Camera Firmware

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: VulDB

Description

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76584

Affected Vendors & Products

Vendor	Product	Version / Range
trendnet	tv-ip751wic	11.03.03

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in TRENDnet TV-IP751WIC firmware version 11.03.03. It exists in the /cgi-bin/admin/set_time.cgi component where the Currenttime argument is manipulated, leading to memory corruption. The flaw can be exploited remotely and a public exploit is available.

Detection Guidance

This vulnerability involves a stack-based buffer overflow in TRENDnet TV-IP751WIC via the /cgi-bin/admin/set_time.cgi endpoint. To detect it, scan for devices exposing this CGI endpoint on port 80 or 443. Use network scanners like Nmap to identify vulnerable devices: nmap -p 80,443 --script http-vuln* <target_IP>. Check for the presence of /cgi-bin/admin/set_time.cgi in HTTP responses.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the device, potentially gaining control over it. This may lead to unauthorized access, data theft, or disruption of the device's functionality. Since it's a network camera, it could also be used as a pivot point for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data captured by the camera, violating GDPR's data protection requirements. For HIPAA, if the device is used in healthcare settings, it may compromise protected health information, leading to compliance violations and legal consequences.

Mitigation Strategies

Immediately update the TRENDnet TV-IP751WIC firmware to the latest version if an update is available. Disable remote access to the vulnerable CGI endpoint /cgi-bin/admin/set_time.cgi if not required. Implement network segmentation to isolate the device from critical systems. Monitor network traffic for unusual activity targeting this device.

Hi! I’m here to help you understand CVE-2026-76584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70