A stack-based buffer overflow exists in the add_apcdb function of /setup.cgi when the mac_pc_dba parameter is manipulated. This flaw can corrupt the call stack, and although the description does not explicitly confirm arbitrary code execution, the overflow is a well-known vector for executing attacker-supplied code, so it is inferred that remote code execution is possible.

The affected product is the Trendnet TEW‑657BRM wireless router running firmware version 1.00.1. This model has been discontinued and reached end‑of‑life since 2011, and no security updates are supplied.

The flaw can be triggered remotely and public exploits exist, giving the threat actor a ready-to-use attack path. The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests low likelihood of current exploitation. The vendor’s product is no longer supported, and the vulnerability is not listed in the CISA KEV catalog, yet the combination of a high-impact remote trigger and the absence of a vendor fix makes it a significant risk.