The vulnerability resides in the add_apcdb function of the /setup.cgi script on the Trendnet TEW‑657BRM firmware 1.00.1. A malformed mac_pc_dba argument overflowing a stack buffer can be triggered from a remote attacker. The high CVSS score of 8.7 reflects the potential for arbitrary code execution with the privileges granted to the web‑server process. Publicly documented exploits confirm that this weakness can already be abused, making it a tangible threat to any device still connected to a network.

Only Trendnet TEW‑657BRM 1.00.1 devices are affected. The product has been discontinued and is not supported by the vendor, so no official patch or update is available. The flaw is confined to the specific firmware package distributed for this router model.

The flaw scores high on the CVSS scorecard but has no EPSS rating; it is not listed in the CISA KEV catalog. The remote exploitation path requires network access to the device’s web interface, a condition that is often satisfied in typical residential or small‑office deployments. Because the device is obsolete, the likelihood of exploitation depends largely on whether it remains connected to an internet‑exposed network and whether any mitigations (disabling remote access) are applied.