CVE-2024-0919

Deeper analysis

CVE-2024-0919 is a command-injection vulnerability in the TRENDnet TEW-815DAP wireless access point running firmware 1.0.2.0. It resides in the do_setNTP function of the POST Request Handler, where unsanitized values supplied to the NtpDstStart and NtpDstEnd parameters are passed to an operating-system command. The flaw is tracked as CWE-77 and carries a CVSS 3.1 base score of 8.8.

An attacker who can authenticate to the device’s web interface (low-privilege account, no user interaction required) may submit a crafted HTTP POST request that results in arbitrary command execution on the underlying system. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the device. The attack is entirely remote and the proof-of-concept has already been published.

The vendor was notified prior to disclosure but did not respond or issue a patch. Public references, including the detailed Notion report, contain only the exploit description and do not list work-arounds or firmware updates. The EPSS score rose from a low baseline to a peak of 0.4768 (currently 0.3681), indicating measurable post-disclosure interest in the flaw.