Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-28846

A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40dcd0 when calling fprintf with "%s: key len = %d, too long\n" format. The two variables seem to be put in the wrong order. The vulnerability could be triggered by sending the POST request to apply_cgi with a long and unknown key in the request body.

Published

2021-08-10T20:15:08.417

Last Modified

2024-11-21T06:00:19.383

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-134
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System trendnet tew-755ap_firmware 1.11b03 Yes
Hardware trendnet tew-755ap - No
Operating System trendnet tew-755ap2kac_firmware 1.11b03 Yes
Hardware trendnet tew-755ap2kac - No
Operating System trendnet tew-821dap2kac_firmware 1.11b03 Yes
Hardware trendnet tew-821dap2kac - No
Operating System trendnet tew-825dap_firmware 1.11b03 Yes
Hardware trendnet tew-825dap - No
References