Critical Stack-Based Buffer Overflow in TRENDnet WLC Allows Remote Code Execution (CVE-2026-75784)

Overview

CVE-2026-75784 is a critical, remotely exploitable stack-based buffer overflow in TRENDnet TEW-WLC100 wireless LAN controllers. The flaw resides in the nginx HTTP header handler, enabling unauthenticated attackers to execute arbitrary code. With a CVSS score of 10.0 and a public exploit, this vulnerability demands immediate remediation for impacted systems.

Technical Analysis

The vulnerability exists in the nginx binary's Server header parsing logic (FUN_0040da4c), where insufficient bounds checking on input allows overflows into adjacent stack memory. Attackers can trigger code execution by delivering a malicious HTTP request with a specially crafted, oversized Server header value. The exploit does not require authentication, and the vulnerable function is invoked during routine HTTP request processing, making exploitation straightforward and reliable.

Enterprise & DIB Impact

DIB and enterprise environments using the TRENDnet TEW-WLC100 in control plane or network infrastructure roles face an immediate risk of unauthenticated device compromise. Successful exploitation would allow attackers to establish persistent footholds, exfiltrate sensitive configuration data, or disrupt wireless operations in critical industrial and enterprise settings.

Recommended Actions

• Apply the latest firmware update from TRENDnet's official repository
• deploy network-layer monitoring for anomalous HTTP headers targeting port 80/443
• enforce strict access controls on the device's administrative API interface
• utilize WAF rules to inspect and block oversized/custom HTTP headers
• and validate network telemetry for signs of lateral movement post-compromise