A critical, remotely exploitable stack-based buffer overflow in the TRENDnet TEW-WLC100 wireless controller could lead to full device compromise.

The flaw resides in the HTTP Header Handler function within the Nginx component of the device. By manipulating the Server argument in an HTTP request, an unauthenticated attacker can trigger a stack-based buffer overflow, resulting in memory corruption and potential code execution.

This vulnerability allows for unauthenticated remote code execution on the wireless controller, which is a critical infrastructure component. Exploitation could lead to total loss of control over the wireless network, enabling man-in-the-middle attacks or the exfiltration of sensitive traffic. Given the CVSS score of 10.0, this represents a severe threat to network availability and security.

Immediate Action: Apply the latest firmware update provided by TRENDnet to address the buffer overflow in the Nginx component.

Proactive Monitoring: Inspect network traffic for malformed HTTP headers and monitor the device for unexpected crashes or reboots.

Compensating Controls: Use a Web Application Firewall or network access control list to restrict management interface access to trusted internal IP addresses only.

Public Exploit Available: Yes — a public proof-of-concept script is available on GitHub.

Due to the availability of a public exploit and the critical nature of this device in network operations, administrators should prioritize patching immediately. If a patch is not currently available, isolate the device management interface from all untrusted networks.