CVE-2026-76584 in TV-IP751WIC
Summary
by MITRE • 08/20/2026
A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The TRENDnet TV-IP751WIC network camera, specifically running firmware version 11.03.03, contains a critical security vulnerability within its embedded web server component known as alphapd. This device is designed to provide remote video surveillance capabilities, relying heavily on the integrity of its configuration interfaces for proper operation and administrative control. The specific flaw resides in the file /cgi-bin/admin/set_time.cgi, which is responsible for handling time synchronization requests from administrators or automated systems. During normal operations, this endpoint accepts input parameters to set the system clock, including a parameter named Currenttime that specifies the desired date and time values.
The technical root cause of this vulnerability is a stack-based buffer overflow condition triggered by improper bounds checking when processing the Currenttime argument. The underlying C code fails to validate the length of the user-supplied data before copying it into a fixed-size stack-allocated buffer. When an attacker provides a string that exceeds the allocated memory space, the excess data overwrites adjacent memory locations on the call stack. This corruption can overwrite critical control data such as the return address, instruction pointer, or other function pointers stored in the frame. Because this processing occurs within the alphapd service which typically runs with elevated privileges to manage device settings, successful exploitation allows an attacker to gain arbitrary code execution capabilities at a high privilege level on the compromised system.
The operational impact of this vulnerability is severe due to its remote nature and the availability of public exploits. An unauthenticated attacker can launch attacks over the network without needing prior access credentials, provided they have network connectivity to the device's management interface. The existence of publicly released exploit code significantly lowers the barrier for entry, enabling both automated scanning tools and less sophisticated attackers to compromise vulnerable devices at scale. Once exploited, an adversary can execute arbitrary commands on the embedded Linux operating system underlying the camera. This could lead to a complete takeover of the device, allowing the attacker to use it as a pivot point into internal networks, install persistent backdoors, or disrupt surveillance operations by altering logs and configurations.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input (Classic Buffer Overflow) and is categorized under ATT&CK technique T1190 Exploit Public-Facing Application. The remote exploitability places it in the initial access or privilege escalation phases depending on whether authentication was required prior to exploitation, though the description suggests unauthenticated access is possible for this specific vector.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary defense is to apply the firmware update provided by TRENDnet that patches the buffer overflow in the set_time.cgi handler. If an official patch is unavailable or delayed, network-level controls should be implemented immediately. This includes restricting access to the camera's management interface using firewall rules to allow only trusted IP addresses and disabling remote administration features if not strictly necessary. Additionally, deploying intrusion detection systems with signatures for known buffer overflow exploits targeting embedded web servers can help detect and block attempted attacks in real time. Regular vulnerability assessments of IoT devices are essential to identify such flaws before they are actively exploited in the wild.