CVE-2012-4876: TRENDnet SecurView camera ActiveX control stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication and public exploit code, though exploitation requires the victim to load a page with the ActiveX control installed.

What it is

The UltraMJCam ActiveX control shipped with the TRENDnet SecurView TV-IP121WN wireless camera contains a stack-based buffer overflow. A long string passed to the OpenFileDlg method overwrites stack memory, allowing arbitrary code execution. The flaw matters because the control is reachable from a browser and public exploit code exists.

Impact

An attacker who can get the control instantiated can run arbitrary code with the privileges of the user running the browser or application hosting the ActiveX control.

Attack surface

Reached over the network through the ActiveX control's OpenFileDlg method, typically by luring a user to a malicious web page that instantiates the control. No authentication is required, but the victim must load the page and the control must be installed and permitted to run.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.71, 99th percentile) and multiple references are tagged Exploit, including Exploit-DB and Bugtraq posts, indicating public exploit code is available.

What to do

• Apply the vendor fix or remove/disable the UltraMJCam ActiveX control; check TRENDnet's advisory for the supported replacement or firmware.
• If no patch is available, kill-bit the affected CLSID in Internet Explorer or block it via Group Policy.
• Restrict browser ActiveX execution and limit use of the affected camera management interface to trusted hosts.
• Segment camera and management networks so a compromised host cannot pivot to other systems.
• Retire or replace the TV-IP121WN if it is no longer supported by the vendor.

Detection

• Monitor for processes loading the UltraMJCam ActiveX control (e.g., .ocx module loads) outside expected management workflows.
• Alert on browser or Office processes spawning unusual child processes, a common sign of ActiveX exploitation.
• Search proxy and web logs for pages or hosts known to deliver the exploit against the OpenFileDlg method.
• Review endpoint telemetry for stack-overflow crash reports tied to the camera control module.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.