TRENDnet TEW-821DAP cgi/ssi Stack Overflow RCE PoC and Analysis

Vulnerability Report: TEW-821DAP cgi/ssi NTP/Timezone Configuration Stack Buffer Overflow Submission Metadata VulnDB Title: TRENDnet TEW-821DAP cgi/ssi NTP/Timezone Configuration Stack-Based Buffer Overflow Disclosure Status: Not Submitted — Draft Ready Affected Products Vendor: TRENDnet Product: TEW-821DAP Wireless Access Point Firmware Version: v2.2.01b05 Affected Binary: Hardware Platform: MIPS32 BE Embedded Authentication Required: No (LAN/WAN) Vulnerability Classification Vulnerability Type: Stack-Based Buffer Overflow / Remote Code Execution (RCE) CVE ID: CWE-121 — Stack-Based Buffer Overflow CVSS v3.1 Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High Description A stack-based buffer overflow vulnerability exists in the binary of TRENDnet TEW-821DAP access point firmware v2.2.01b05. The NTP and timezone configuration handlers retrieve user-provided configuration values (including , , , and related parameters) via and copy them into a fixed-size stack buffer using without any bounds checking. An unauthenticated attacker can provide oversized values for these parameters, overflowing the stack buffer and overwriting the return address ($ra) to achieve arbitrary code execution with root privileges. Technical Details Root Cause The vulnerable code path is: The CGI handler processes NTP and timezone configuration requests (e.g., ). User-controlled UCI configuration parameters are read via and then copied into a fixed-size stack buffer using the unsafe function. No length validation is performed prior to copying. When an attacker-supplied parameter value exceeds the length of the stack buffer, a buffer overflow occurs, overwriting adjacent stack memory, including the saved return address. FirmRec / Symbolic Execution Evidence Multiple overflow points were confirmed via symbolic execution with FirmRec—the program counter was reliably overwritten with ('AAAA'), confirming attacker control over the execution flow. Affected Parameters Proof of Concept Expected Result The stack buffer is overflowed with 68 bytes of padding followed by the target address , which overwrites the saved return address. The device crashes or reboots when the function attempts to return. Using a custom ROP chain, arbitrary code execution can be achieved. Impact Successful exploitation allows an unauthenticated remote attacker to: Corrupt the device's stack memory beyond the boundaries of the fixed buffer Overwrite the saved return address and control the instruction pointer (PC) Execute arbitrary code with root privileges on the MIPS32 BE architecture Deploy persistent implants, backdoors, or botnet agents on the access point Use the compromised device as a pivot to attack other internal network hosts Cause Denial of Service (device crash/reboot loop) The attack requires no user interaction or authentication, making it exploitable via LAN or WAN whenever the management interface is accessible. Solution / Mitigation Vendor Recommendations 1. Replace all calls with bounded copy functions (e.g., or ) to ensure enforcement of the target buffer size. 2. Validate the length of all UCI configuration parameters prior to copying them into the stack buffer. 3. Enable stack canaries ( ) and compile with . 4. Enable NX/DEP (No-Execute/Data Execution Prevention) and ASLR (Address Space Layout Randomization) where supported by the platform. 5. Conduct a comprehensive audit of all - call chains within the codebase. User Mitigations (Until a Patch is Available) Restrict access to the device's web management interface via firewall rules. Disable management access on the WAN side. Block access to at the network edge whenever possible. Discovery Method Tools: ang 9.2.221 CFGFast + Symbolic Execution (FirmRec/simexec) Analysis: MIPS32 BE Binary Static Analysis — - Data Flow Tracing Evidence: 8 FirmRec/simexec hits, PC= across 2 distinct sink addresses

Goal Reached Thanks to every supporter — we hit 100%!

TRENDnet TEW-821DAP cgi/ssi Stack Overflow RCE PoC and Analysis

More from this source