Remote Stack-based Buffer Overflow in TRENDnet TV-IP751WIC

A critical stack-based buffer overflow vulnerability has been identified in the TRENDnet TV-IP751WIC network camera, specifically within the 'alphapd' web server component. The vulnerability, tracked as CVE-2026-75877, affects firmware version 11.03.03. The issue stems from improper boundary management within several administrative and configuration functions, including SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, and websCheckRealm.

An attacker can trigger this overflow remotely by sending a specifically crafted request to these functions, leading to memory corruption. Because the 'alphapd' component runs as a core service, successful exploitation may allow for unauthenticated or low-privileged remote code execution. Proof-of-concept exploit code has been publicly released, increasing the risk of immediate exploitation. This vulnerability is particularly severe due to the remote, unauthenticated nature of the potential exploit chain and the administrative reach of the affected component.

Attack Chain

1. Attacker performs network reconnaissance to identify internet-facing TRENDnet TV-IP751WIC devices.
2. Attacker probes the device to confirm the target firmware version (11.03.03).
3. Attacker crafts a malicious HTTP request targeting one of the identified vulnerable functions (e.g., SystemNetworkChanged).
4. Attacker includes an overly large payload within the request parameters to initiate a stack-based buffer overflow in the alphapd binary.
5. The alphapd service fails to validate input length, resulting in the overwrite of the return address on the stack.
6. The process redirects execution flow to the attacker-supplied shellcode embedded in the payload.
7. Attacker gains arbitrary code execution with the privileges of the alphapd process.
8. Attacker establishes persistence or pivots into the internal network from the compromised camera.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.9, representing a critical risk. Successful exploitation allows for complete compromise of the affected camera, leading to loss of confidentiality, integrity, and availability. Potential impacts include unauthorized access to video feeds, lateral movement into internal enterprise networks from the IoT device, and potential device bricking.

Recommendation

• Immediately isolate all TRENDnet TV-IP751WIC devices from the public internet using firewalls or VPN requirements.
• Monitor internal network traffic originating from IoT segments for anomalous connections to or from these devices.
• Patch the affected devices if a firmware update is released by the vendor; prioritize decommissioning devices if no patch is available for the 11.03.03 version.
• Restrict administrative access to the web interface to trusted management VLANs only.