Trendnet TEW-635BRM up to 1.00.03 Web Service /sbin/rc start_httpd device_name stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function start_httpd of the file /sbin/rc of the component Web Service. Performing a manipulation of the argument device_name results in stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is reported as CVE-2026-15480. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices."

Detailsinfo

A vulnerability, which was classified as critical, was found in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. The manipulation of the argument device_name with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-15480. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Trendnet

Name

• TEW-635BRM

Version

• 1.00.03

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #838236: TRENDnet TEW-635BRM V1.00.03 Stack-based Buffer Overflow (by jfkk)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion