TRENDnet TEW-821DAP 1.12B01 web interface buffer overflow

CVE-2026-15484 is a CWE-119 buffer overflow in the TRENDnet TEW-821DAP AC1200 Dual Band PoE Access Point, firmware 1.12B01 on hardware v1.xR. TRENDnet has previously acknowledged that TEW-821DAP firmware families carry buffer overflow and command injection issues in the web management interface reachable after authentication, which is consistent with the CVSS vector AV:N/AC:L/PR:L. Successful exploitation lands code execution on the AP's Linux userland, giving full pivot into whatever VLAN the management interface sits on.

The vendor HIGH (8.8) rating is defensible on paper — you get full C/I/A impact — but it substantially overstates the enterprise risk. The device is a legacy SOHO/small-business AP, not deployed in managed enterprise fleets at meaningful volume, and exploitation requires valid admin credentials on the web UI. In a hardened deployment (management VLAN + non-default creds + no WAN-side admin) the reachable population is a rounding error. Treat this as a MEDIUM in a managed environment; it stays HIGH only if you actually run these APs with default creds on a flat network.

Sources.

1. TRENDnet TEW-821DAP product page
2. TRENDnet TEW-821DAP firmware downloads
3. TRENDnet customer support / advisories
4. OpenCVE — TRENDnet CVE listings
5. Feedly — Latest TRENDnet vulnerabilities
6. TRENDnet CVE Vulnerabilities & Metrics (akaoma)
7. TRENDnet threat intelligence index
8. CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Run this from an auditor workstation on the management VLAN with reachability to the AP. Invoke as ./check-tew821dap.sh 10.0.0.5 where the argument is the AP's management IP. Requires only curl — no credentials, no privileges on the target.

#!/usr/bin/env bash
# noisgate check for CVE-2026-15484 (TRENDnet TEW-821DAP v1.12B01 buffer overflow)
# Fingerprints firmware version via the login/status pages.
# Exit codes: 0 PATCHED / not-affected model, 1 VULNERABLE, 2 UNKNOWN
set -u

if [[ $# -lt 1 ]]; then
  echo "usage: $0 <ap-mgmt-ip> [port]" >&2
  exit 2
fi

TARGET="$1"
PORT="${2:-80}"
URL="http://${TARGET}:${PORT}"
UA="noisgate-check/1.0"

BODY=$(curl -sS --max-time 5 -A "$UA" "${URL}/login.asp" "${URL}/status.asp" "${URL}/index.asp" 2>/dev/null || true)

if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: no HTTP response from ${TARGET}:${PORT}"
  exit 2
fi

if ! echo "$BODY" | grep -qiE 'TEW-821DAP|TRENDnet'; then
  echo "UNKNOWN: not a TEW-821DAP admin interface"
  exit 2
fi

if echo "$BODY" | grep -qE '1\.12B01|v1\.12'; then
  echo "VULNERABLE: ${TARGET} is TEW-821DAP firmware 1.12B01 (CVE-2026-15484)"
  exit 1
fi

if echo "$BODY" | grep -qE 'v2\.[0-9]+'; then
  echo "PATCHED: ${TARGET} is hardware v2 — not in affected range"
  exit 0
fi

echo "UNKNOWN: TEW-821DAP detected but firmware string not parsed — inspect manually"
exit 2