A stack-based buffer overflow exists in the update_pcdb function of the setup.cgi script on Trendnet TEW-657BRM routers. By sending a specially crafted mac_pc_dba argument, an attacker can overflow a stack buffer and potentially execute arbitrary code on the device. The vulnerability is exploitable remotely; the exploit has been publicly released, so anyone with network access to the device may target it.

The flaw affects only Trendnet TEW-657BRM routers running firmware version 1.00.1. These units were discontinued and have been out of support since June 23 2011, meaning the vendor no longer provides updates or confirmation of the issue.

The CVSS score of 8.7 indicates a high severity level, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint over the network, though the lack of vendor support limits official mitigations and increases the importance of network isolation or device replacement.