Security readout for executives and security teams
Plain-English summary
This CVE affects several TRENDnet wireless access point models running firmware 1.11B03. A malformed administrative POST request can crash the device, causing denial of service. Sources do not show data theft, code execution, a patch, CVSS score, or confirmed active exploitation.
Executive priority
Treat this as a targeted infrastructure availability risk, not a confirmed breach indicator. Prioritize exposed or business-critical wireless access points first, then confirm vendor support status and remediation options.
Technical view
The issue is described as a format string vulnerability caused by variables passed in the wrong order to an fprintf call. It can be triggered through apply_cgi with a long unknown key in the request body, leading to denial of service on named TRENDnet firmware builds.
Likely exposure
Exposure is limited to TRENDnet TEW-755AP, TEW-755AP2KAC, TEW-821DAP2KAC, and TEW-825DAP devices on firmware 1.11B03. Risk is higher where management interfaces are reachable from untrusted networks.
Exploitation context
The CVE states a remote malicious user could cause denial of service. The source bundle does not include KEV listing, observed exploitation, public exploit confirmation, authentication requirements, or vulnerable configuration details.
Researcher notes
Evidence is narrow: the CVE description names affected models and a denial-of-service trigger, while metadata lacks CVSS, CWE, CPEs, and patch details. Avoid assuming broader TRENDnet exposure without vendor confirmation.
Mitigation direction
- Inventory TRENDnet access points and record exact model and firmware version.
- Restrict administrative interfaces to trusted management networks only.
- Check TRENDnet advisories and firmware downloads for vendor-approved updates or replacements.
- Disable external reachability to apply_cgi and management services where possible.
- Replace affected devices if no supported vendor fix is available.
Validation and detection
- Confirm whether any named TRENDnet models run firmware 1.11B03.
- Verify management interfaces are not internet-accessible or guest-network-accessible.
- Review device logs for unexplained crashes, reboots, or configuration POST activity.
- Check vulnerability scanners and CMDB entries for matching model and firmware evidence.
- Document any compensating network controls around affected access points.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-28846 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/zyw-200/EQUAFL/blob/main/TRENDnet%20ticket.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.