CVE-2026-129351 in TEW-657BRM
Summary
by MITRE • 11/15/2026
A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know." This vulnerability only affects products that are no longer supported by the maintainer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The TRENDnet TEW-657BRM wireless router, specifically running firmware version 1.00.1, contains a critical memory corruption flaw within its embedded web server component known as mini_httpd. This vulnerability is located in the /setup.cgi script and stems from an improper implementation of the sprintf function during string manipulation operations. The core technical issue is an out-of-bounds write condition, which occurs when user-supplied input exceeds the allocated buffer size without adequate boundary checks or length validation by the application logic. In embedded systems like this router, such memory corruption can lead to arbitrary code execution, denial of service through system crashes, or potential privilege escalation depending on how the overwritten memory is utilized by subsequent processes.
From a technical classification perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. The vulnerability allows for remote exploitation because the affected CGI script is accessible via standard HTTP requests over the network interface. An attacker does not require authentication to trigger the malformed input, making this a significant risk for devices that are often deployed in untrusted or semi-trusted network segments. The public disclosure of an exploit means that automated scanning tools and malicious actors can readily leverage this weakness against vulnerable instances without needing specialized knowledge beyond standard web interaction techniques.
The operational impact is severe due to the nature of embedded IoT devices which typically run with high privileges on limited hardware resources. Successful exploitation could allow a remote attacker to gain full control over the router, potentially using it as a pivot point for further network attacks or installing persistent malware such as botnet agents. However, the practical risk landscape is heavily mitigated by the product lifecycle status. TRENDNet has officially declared this model End of Life more than fifteen years ago and does not provide security patches or firmware updates to address this issue. The vendor's stance indicates that while they acknowledge the existence of the vulnerability in legacy codebases, they do not consider it actionable for supported products since none remain under maintenance.
Mitigation strategies must therefore focus on network isolation rather than software remediation. Since no patch is available, administrators should ensure that any remaining instances of this device are disconnected from untrusted networks such as the public internet. If the devices are still in use within a local area network, they should be placed behind strict firewall rules that block all inbound HTTP and HTTPS traffic to the management interface. Additionally, disabling remote administration features and restricting access to trusted IP addresses only can reduce the attack surface significantly. Organizations relying on legacy infrastructure must recognize that these systems represent inherent security risks due to their lack of ongoing support and should plan for immediate decommissioning in favor of modern, supported networking equipment that receives regular security updates aligned with current industry standards like NIST guidelines for IoT device lifecycle management.