TRENDnet router bug gets a 'perfect' CVSS 10 - but the score comes from the bug hunter, not NIST

The headline number

CVE-2026-77946 has landed with the kind of score that makes security folk sit up: 10.0 out of 10 on the CVSS 3.1 scale, and 9.3 on the newer CVSS 4.0 scale. Both labelled “critical”. That’s about as bad as these ratings get on paper. The catch is that neither figure comes from NIST’s National Vulnerability Database itself - both are supplied by VulDB, the vulnerability-tracking outfit that also acts as the “CNA” (the body responsible for assigning the CVE). NVD’s own assessment field simply reads “N/A”, and the record has been flagged “Not Scheduled” for further NVD review, which in plain terms means nobody at NIST has independently checked the severity claim yet.

What the bug actually does

The flaw sits in a TRENDnet TEW-821DAP wireless access point running firmware version 2.2.01b05. According to the NVD listing, a function called uci_safe_get, part of the device’s web-based NTP (network time) and timezone configuration handler, mishandles certain input fields - things like the NTP server address or syslog server setting. Feed it the wrong data and it triggers a stack-based buffer overflow, a classic memory-corruption bug that can, in the worst case, let an attacker run their own code on the device. Because the vulnerable page is accessed over the network, NVD notes the attack “may be launched remotely” without needing physical access, and a working exploit has already been published openly.

So who is actually at risk

This is not a Windows patch-Tuesday situation affecting millions of desktops, nor a flaw in some widely embedded library. It’s specific to one consumer-grade access point model from TRENDnet, running one particular firmware build. If you don’t own a TEW-821DAP, this bug has nothing to do with you. Even if you do, the vulnerable function is reached through the device’s administrative web interface - the same interface that, on most home networks, isn’t exposed to the open internet unless someone has deliberately forwarded ports or enabled remote management. Publicly disclosed exploit code raises the theoretical risk, since anyone curious enough can find and try it, but “publicly disclosed” is not the same as “actively being exploited in the wild” - NVD makes no such claim, and there’s no confirmation of real-world attacks. There’s also no information yet on install numbers, so it’s hard to say whether this is thousands of devices or a handful.

What to do about it

There is no mention in the NVD record, nor in the linked write-ups, of a firmware patch from TRENDnet. Until one appears, the sensible precautions are the boring, familiar ones: make sure the router’s admin panel isn’t reachable from outside your home network, keep remote management switched off unless you genuinely need it, and check TRENDnet’s support pages periodically for a firmware update addressing this specific issue.

The takeaway

A CVSS 10 sounds terrifying, but the number here is a third-party estimate attached to a fairly narrow bug in one older access point model, not an NVD-verified crisis or an active mass exploitation campaign. Worth locking down if you own the affected TRENDnet kit; not something the rest of us need to lose sleep over.