CVE-2021-28842 – A null pointer dereference vulnerability in TRE... (How to Fix)

Q: What is the severity of CVE-2021-28842?

CVE-2021-28842 has a CVSS score of 7.5 (HIGH). A null pointer dereference vulnerability in TRENDnet wireless access points allows remote attackers to cause denial of service by sending a specially crafted POST request without proper authentication. This affects multiple TRENDnet access point models running firmware version 1.11B03. Attackers can crash the device without authentication.

📋 TL;DR

A null pointer dereference vulnerability in TRENDnet wireless access points allows remote attackers to cause denial of service by sending a specially crafted POST request without proper authentication. This affects multiple TRENDnet access point models running firmware version 1.11B03. Attackers can crash the device without authentication.

💻 Affected Systems

Products:

TRENDnet TEW-755AP
TRENDnet TEW-755AP2KAC
TRENDnet TEW-821DAP2KAC
TRENDnet TEW-825DAP

Versions: 1.11B03

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All devices running affected firmware are vulnerable in default configuration

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device crash requiring physical reboot, disrupting all wireless connectivity for connected users

🟠

Likely Case

Temporary denial of service affecting wireless network availability until device reboots

🟢

If Mitigated

No impact if device is patched or network segmentation prevents access to management interface

🌐 Internet-Facing: HIGH - Exploit requires only network access to management interface, which may be exposed

🏢 Internal Only: HIGH - Even internal attackers can exploit this without authentication

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit requires sending a single malformed HTTP POST request to apply_cgi endpoint

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: No official vendor advisory found

Restart Required: No

Instructions:

Check TRENDnet website for firmware updates. If available, download latest firmware and apply through web interface.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate access point management interfaces from untrusted networks

Access Control Lists

all

Restrict access to management interface IP addresses

🧯 If You Can't Patch

Replace affected devices with updated models or different vendors
Implement network monitoring for exploit attempts and prepare incident response

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web interface. If version is 1.11B03 on affected models, device is vulnerable.

Check Version:

Check web interface at http://[device-ip]/ or use SNMP if configured

Verify Fix Applied:

Verify firmware version is updated beyond 1.11B03

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /apply_cgi with action=do_graph_auth missing login_name parameter
Device reboot logs without normal shutdown

Network Indicators:

HTTP traffic to device management interface with malformed POST requests
Sudden loss of connectivity to access point

SIEM Query:

http.method:POST AND http.uri:"/apply_cgi" AND http.param.action:"do_graph_auth" AND NOT http.param.login_name:*

📊 Metadata

CVE ID: CVE-2021-28842

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: August 10, 2021

Last Updated: November 21, 2024

🔗 References

https://github.com/zyw-200/EQUAFL/blob/main/TRENDnet%20ticket.pdf Third Party Advisory
https://github.com/zyw-200/EQUAFL/blob/main/TRENDnet%20ticket.pdf Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-28842, you might also want to check these: