Description
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-13
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

The flaw is a stack-based buffer overflow triggered by the Name argument in the formTcpipSetup function, which is reachable through the router’s web interface. An attacker can supply an overly long value to this field, causing memory corruption and allowing arbitrary code execution. The vulnerability is triggered remotely via standard HTTP requests to the device’s management interface, and the public exploit remains available.

Affected Systems

The defect affects TRENDnet routers running the TEW-432BRP firmware version 3.10B20. It is limited to this specific firmware, which is no longer supported by the vendor.

Risk and Exploitability

The severity score of 9.4 on the CVSS scale indicates critical risk, and although no EPSS score is provided, the flaw is publicly exploitable and not yet listed in the CISA KEV catalog. The attack vector is remote, using only network connectivity to the router’s WAN side, making it highly convenient for an external adversary to leverage this overflow.

Generated by OpenCVE AI on October 13, 2026 at 12:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor or third‑party patch that addresses the formTcpipSetup overflow.
  • If no patch is available, block external access to the router’s management interface by configuring the firewall or disabling WAN management.
  • Replace the device with a supported and maintained model, or isolate the router on a separate network segment with strict access controls.

Generated by OpenCVE AI on October 13, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Title TRENDnet TEW-432BRP formTcpipSetup stack-based overflow
First Time appeared Trendnet
Trendnet tew-432brp Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:trendnet:tew-432brp_firmware:*:*:*:*:*:*:*:*
Vendors & Products Trendnet
Trendnet tew-432brp Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Trendnet Tew-432brp Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T10:45:18.396Z

Reserved: 2026-10-12T12:00:50.049Z

Link: CVE-2026-109157

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T11:17:14.873

Modified: 2026-10-13T11:17:14.873

Link: CVE-2026-109157

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T12:30:07Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow