CVE-2026-77946

CriticalCVSS 10.0/10Last modified Oct 12, 2026

Description

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the argument system.ntp.server/system.ntp.enable_server/cameo.time.time_zone/cameo.cameo.syslog_server can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-77956.4The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in CVE-2026-779506.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker CVE-2026-779554.4In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located be CVE-2026-779568.9Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execu CVE-2026-77966.4The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stor CVE-2026-779605.3Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs CVE-2026-779668.8The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenti CVE-2026-779678.1The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association wit CVE-2026-779688.2A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh CVE-2026-77977.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL In CVE-2026-779705.9Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated CVE-2026-779729.0Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach intern