| Title | TRENDnet TEW-657BRM 1.00.1 Buffer Overflow |
|---|
| Description | An out-of-bounds write vulnerability was identified in TRENDnet TEW-657BRM firmware 1.00.1 (hardware revision v1.0R).
The vulnerability exists in the mini_httpd web server's HTTP request processing logic. When processing a request path containing ".htm", the server uses an unbounded sprintf operation to construct a redirect string in a fixed-size global buffer. An excessively long request path can overwrite adjacent memory and control-flow-related data.
The vulnerable code is reached before HTTP Basic authentication, allowing an unauthenticated remote attacker with access to the web management interface to trigger the vulnerability.
In the supplied re-hosted QEMU-MIPS test environment, a crafted HTTP request caused memory corruption. The research materials report program-counter control and execution of a benign test payload in the emulated process.
The affected web server runs with root privileges. Successful exploitation may result in arbitrary code execution in the context of the web server. However, code execution on physical hardware has not been demonstrated.
Affected vendor: TRENDnet
Affected product: TEW-657BRM
Hardware revision: v1.0R
Affected firmware: 1.00.1
Affected component: mini_httpd
Vulnerability type: Out-of-bounds Write / Buffer Overflow
CWE: CWE-787
Attack vector: Remote HTTP request
Authentication required: No
Testing environment: Re-hosted QEMU-MIPS firmware environment
The issue affects the pre-authentication HTTP request handling logic in mini_httpd and is separate from the previously disclosed setup.cgi vulnerabilities affecting this device.
|
|---|
| Source | ⚠️ https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md |
|---|
| User | ruanyi (UID 102203) |
|---|
| Submission | 10/19/2026 16:52 (26 days ago) |
|---|
| Moderation | 11/14/2026 07:31 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 437397 [TRENDnet TEW-657BRM 1.00.1 mini_httpd /setup.cgi sprintf out-of-bounds write] |
|---|
| Points | 20 |
|---|