'Perfect 10' bug in an old TRENDnet Wi-Fi controller's nginx binary - but check who actually owns one
A stack overflow in a bundled nginx binary has earned the maximum CVSS score, but the affected device is a niche, ageing wireless controller rather than anything on your desk.
A newly published vulnerability, CVE-2026-75784, has been handed a top-of-the-scale CVSS 3.x score of 10.0 by third-party scoring outfit VulDB, with NIST’s own National Vulnerability Database entry confirming the flaw exists but not yet issuing its own independent rating. That headline number sounds terrifying. The actual blast radius is much smaller than “critical” implies.
What the bug actually does
The issue sits inside the firmware of the TRENDnet TEW-WLC100 wireless LAN controller, specifically version 1v2.07b01. According to the NVD listing, the problem lives in a function inside the device’s bundled copy of nginx (the web server that likely powers its admin interface), found at /usr/nginx/sbin/nginx. Feeding a manipulated Server header at the HTTP handler triggers a stack-based buffer overflow - a classic memory-corruption bug that, in the worst case, can let an attacker run their own code on the device, and NVD notes the attack “may be launched remotely.”
A proof-of-concept package on GitHub, submitted by a research team, backs this up with a technical report, an exploit script and reverse-engineering evidence pointing to the vulnerable function (labelled FUN_0040da4c, the kind of generic name that decompiler tools like Ghidra assign when analysing a binary without its original source code). That detail matters: this looks like the product of firmware reverse-engineering rather than a vendor-disclosed bug, and NVD confirms the exploit code is already public.
Worth flagging too: the scoring isn’t entirely consistent between sources. NVD’s page shows VulDB rating it 10.0 under CVSS 3.1, but the GitHub researchers’ own draft report suggests 9.8. Both are “critical,” but the discrepancy is a reminder that these scores are assessments, not physical laws - useful for triage, not gospel.
So who is actually at risk
This is not a router, phone or PC most people own. The TEW-WLC100 is a wireless controller aimed at managing multiple access points, typically deployed in small business or institutional Wi-Fi setups rather than homes. It’s also an older product line - the firmware version affected, 1v2.07b01, points to legacy hardware that may not even be receiving active support any more.
Crucially, the sources here don’t confirm two things that would really change the stakes: there’s no evidence in NVD’s record of a patch being available, and no indication that the flaw is being actively exploited beyond the public availability of proof-of-concept code. “Exploit is public” means the recipe exists, not that anyone with a TEW-WLC100 has been hit.
What to do about it
If you or your organisation run a TRENDnet TEW-WLC100 on this firmware version, the sensible move is to check TRENDnet’s own support channels for an updated firmware release and, in the meantime, make sure the device’s admin/web interface isn’t reachable from the open internet - a basic hygiene step that blunts most remote router-class bugs regardless of severity score. For everyone else, this simply isn’t a device you’re likely to own.
The takeaway
A CVSS 10 sounds like the internet is on fire, but context does the heavy lifting here. This is a serious flaw in a specific, ageing piece of business Wi-Fi kit with public exploit code and, as far as these sources show, no confirmed patch yet. If that’s not the box under your desk, there’s nothing to do here beyond noting that “critical” scores always deserve a second look at what’s actually running the software.