The flaw is a stack‑based buffer overflow in the formWPS function of the /goform/formWPS endpoint. A specially crafted value supplied for the peerPin argument overflows a local buffer, corrupting stack memory and permitting an attacker to execute arbitrary code. This type of vulnerability is typically classified as a remote code execution risk because it can be triggered via an untrusted input from the network.

TRENDnet TEW‑432BRP consumer‑grade router running firmware version 3.10B20. The device has been End‑of‑Life since 2009 and no security updates are available.

The CVSS score of 8.7 reflects a high impact level, and the exploit is publicly available, indicating that attackers have operational proof of concept. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the lack of a vendor fix and the public nature of the exploit increase the risk. The exploit can be performed from any remote machine that can reach the device’s HTTP interface; no local privileges are required. The vulnerability is not listed in the CISA KEV catalog, yet its high severity and public exploit suggest that it should be treated with urgency by administrators who still maintain the device.