CVE-2026-129351: TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write
A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component minihttpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which devices are affected?
The affected product is the TRENDnet TEW-657BRM running version 1.00.1. The issue only affects products that are no longer supported by the maintainer.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated. The vulnerability is remotely exploitable through the mini_httpd setup.cgi component.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What is the recommended remediation path?
The vendor states that the product has been end-of-life for more than 15 years and cannot confirm the issue. Because the affected product is unsupported, replacing it with a supported device is the available remediation path described by the data.