CVE-2026-109157: TRENDnet TEW-432BRP formTcpipSetup stack-based overflow
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
TRENDnet TEW-432BRP devices running version 3.10B20 are identified as affected. The issue applies only to products that are no longer supported by the maintainer.
What does an attacker need to exploit the vulnerability?
An attacker can remotely manipulate the Name argument handled by /goform/formTcpipSetup to trigger the stack-based buffer overflow. The available data does not indicate that user interaction is required; the severity vector indicates low-privilege access is required.
Is there a vendor fix available?
No fix is identified in the provided information. TRENDnet states that the router reached end of life in 2011 and that it cannot test whether the vulnerability exists.
What should organizations do if they still operate this router?
Replace or retire affected TEW-432BRP devices, since they are unsupported and no patch is identified. Until replacement, restrict network access to the router management interface to trusted administrative networks and avoid exposing it remotely.
How urgent is remediation?
Prioritize this issue because it is rated critical with a 9.9 severity score, can be initiated remotely, and has a publicly available exploit. The vulnerability can affect confidentiality, integrity, and availability.