CVE-2026-10062 in TEW-432BRP
Summary
by MITRE • 05/29/2026
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/15/2026
The vulnerability identified in TRENDnet TEW-432BRP version 3.10B20 represents a critical stack-based buffer overflow flaw within the web-based management interface of this network device. The vulnerability resides in the formSetRoute function located at /goform/formSetRoute, which processes user-supplied input parameters including ip address, subnet mask, and gateway values. This particular implementation fails to properly validate or sanitize the length of input data passed to the function, creating an exploitable condition where maliciously crafted input can overwrite adjacent memory locations on the stack. The vulnerability's remote exploitability means that an attacker can potentially execute arbitrary code on the device without physical access or local authentication credentials, making it particularly dangerous in networked environments where such devices may be exposed to untrusted networks.
The technical nature of this flaw aligns with common weakness enumeration CWE-121, which describes stack-based buffer overflow conditions where insufficient bounds checking allows attackers to overwrite stack memory. This vulnerability specifically enables privilege escalation and remote code execution through manipulation of network routing parameters that are processed by the affected firmware component. The ATT&CK framework would categorize this under T1210 - Exploitation of Remote Services and T1059 - Command and Scripting Interpreter, as successful exploitation would allow attackers to execute arbitrary commands on the affected device. The exploitation process typically involves crafting specially formatted IP/mask/gateway parameters that exceed the allocated buffer space, causing a stack overflow that can be leveraged to redirect program execution flow and potentially gain full administrative control over the router.
The operational impact of this vulnerability extends beyond simple device compromise, as the affected TRENDnet TEW-432BRP devices are commonly deployed in residential and small office environments where they serve as primary network gateways. When exploited, this vulnerability allows attackers to modify network routing configurations, potentially redirecting network traffic through malicious intermediaries, enabling man-in-the-middle attacks, or creating persistent backdoors for future access. The long-term exposure of such devices in network infrastructure means that even a single compromised router can serve as a foothold for broader network infiltration activities. Organizations that have not upgraded from these legacy devices face significant risk as the vulnerability can be exploited by automated scanning tools, given the public disclosure of exploitation methods and the widespread deployment of these EOL devices in environments where network security controls may be insufficient.
The vendor's response regarding the end-of-life status of the TEW-432BRP since 2009 demonstrates the challenges faced by organizations when dealing with legacy network infrastructure that remains in production use despite lack of vendor support. This situation creates a significant security gap where devices continue to operate with known vulnerabilities that cannot be patched or updated, leaving them exposed to exploitation by threat actors who specifically target unsupported hardware. The vendor's inability to provide a fix or security update for this EOL product represents a common industry problem where manufacturers discontinue support for older products, leaving customers with vulnerable infrastructure in their networks. Organizations should implement network segmentation and access controls to limit exposure of these legacy devices, consider replacing them with supported hardware, and conduct regular vulnerability assessments to identify and mitigate similar risks in their network infrastructure. The presence of this vulnerability in an EOL product serves as a stark reminder of the importance of maintaining up-to-date network security infrastructure and the dangers of continuing to operate unsupported network devices in production environments.