Critical Stack-Based Buffer Overflow in TRENDnet TEW-WLC100

A critical stack-based buffer overflow vulnerability, identified as CVE-2026-75784, affects the TRENDnet TEW-WLC100 wireless controller version 1v2.07b01. The vulnerability resides within the HTTP Header Handler, specifically in the function FUN_0040da4c of the nginx executable (/usr/nginx/sbin/nginx). By sending a specially crafted 'Server' header in an HTTP request, an unauthenticated remote attacker can trigger a memory corruption condition. Successful exploitation of this vulnerability leads to a stack-based buffer overflow, which can be leveraged for arbitrary code execution on the affected device. Publicly available proof-of-concept code confirms that the vulnerability is exploitable. Given the nature of this device as a network controller and the critical CVSS score, immediate attention is required to mitigate remote exploitation risks.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing TRENDnet TEW-WLC100 controllers.
2. Attacker crafts an HTTP request containing an excessively long or malformed string in the 'Server' header field.
3. The request is transmitted to the target device via the network.
4. The HTTP Header Handler component receives and processes the request.
5. The nginx function FUN_0040da4c attempts to parse the 'Server' header argument.
6. Lack of proper bounds checking results in a stack-based buffer overflow.
7. Attacker overwrites critical stack memory to redirect program execution.
8. Final objective is achieved, such as remote code execution or system compromise.

Impact

The vulnerability carries a CVSS score of 10.0, indicating a critical risk of full system compromise. Successful exploitation allows an unauthenticated remote attacker to gain arbitrary code execution capabilities, which could lead to complete loss of confidentiality, integrity, and availability of the wireless controller and potentially the managed network segment.

Recommendation

• Block all unsolicited inbound HTTP requests to the management interface of TRENDnet TEW-WLC100 devices at the network perimeter.
• Patch or upgrade affected devices if a firmware update is provided by TRENDnet to address the vulnerability.
• Implement strict ingress filtering to limit management interface access to authorized administrative IP ranges only.
• Monitor network traffic for HTTP requests containing abnormally large or non-standard 'Server' header values directed at these controllers.