A stack-based buffer overflow was discovered in the nginx HTTP Header Handler on TRENDnet TEW-WLC100. When an attacker sends a specially crafted Server HTTP header, the FUN_0040da4c function writes beyond its stack buffer, corrupting control data. The flaw can be triggered remotely through the device’s HTTP management interface, and public exploit code is available. The vulnerability is classified as CWE-119 and CWE-121.

The affected devices are TRENDnet TEW-WLC100 wireless LAN controllers running firmware 1v2.07b01. No other model or firmware version is listed as vulnerable in the available data.

The flaw carries a CVSS score of 10, indicating critical severity. No EPSS score is available, but the absence of mitigation options combined with the remote exploitation vector suggests a high likelihood of real-world attacks. The vulnerability is not listed in the CISA KEV catalog. If a TEW-WLC100 device is reachable via its HTTP management interface from an external network, attackers can exploit the stack overflow, potentially gaining unauthorized control. The public availability of exploitation tools underscores the urgency of addressing this issue.