Vulnerability · Published Aug 10, 2021 · Assigned by mitre

CVE-2021-28846

Medium 6.5

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)0.8%top 42.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40dcd0 when calling fprintf with "%s: key len = %d, too long\n" format. The two variables seem to be put in the wrong order. The vulnerability could be triggered by sending the POST request to apply_cgi with a long and unknown key in the request body.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/zyw-200/EQUAFL/blob/main/TRENDnet%20ticket.pdf x_refsource_MISC