TRENDnet TEW-432BRP 3.10B20 /goform/formTcpipSetup name stack-based overflow

Summaryinfo

A vulnerability described as very critical has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formTcpipSetup of the file /goform/formTcpipSetup. Executing a manipulation of the argument Name can lead to stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is registered as CVE-2026-109157. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product."

Detailsinfo

A vulnerability classified as very critical was found in TRENDnet TEW-432BRP 3.10B20. This vulnerability affects the function formTcpipSetup of the file /goform/formTcpipSetup. The manipulation of the argument name with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability was named CVE-2026-109157. The exploitation appears to be easy. The attack can be initiated remotely. Technical details and also a public exploit are known. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/12/2026).

It is possible to download the exploit at github.com. It is declared as proof-of-concept. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• TRENDnet

Name

• TEW-432BRP

Version

• 3.10B20

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #979590: TRENDnet TEW-432BRP 3.10B20 Stack-based Buffer Overflow (by pjqwudi)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion