TRENDnet TEW-432BRP: Stack-based buffer overflow in web management interface
Summary
A stack-based buffer overflow in the web management interface of the discontinued TRENDnet TEW-432BRP router (firmware 3.10B20) can be triggered remotely through the name parameter of /goform/formTcpipSetup. The CVSS vector requires low privileges and no user interaction. A public proof of concept exists; the researcher claims arbitrary code execution, while a Positive Technologies advisory describes a remote denial of service. TRENDnet has ended support and will not provide a fix, so affected devices stay vulnerable.
Affected
- TRENDnet TEW-432BRP, firmware 3.10B20
Fixed in
Unknown. No fixed version is available because the product has reached end of life and end of support.
Workaround
- Retire or replace the device. TRENDnet recommends retirement.
- If the device must stay in use for now, remove it from the internet and keep its management interface off WAN.
- Restrict access to the management interface to a trusted administration network.
Exploitation
- A public proof of concept is available. VulDB marks an exploit as available.
- The impact is disputed: the researcher claims code execution, while Positive Technologies describes a denial of service. Code execution is not independently confirmed.
- No evidence of known active exploitation was found. This has not been verified against the CISA KEV catalogue.
Our recommendation
- Identify all TEW-432BRP devices in use, especially any that are internet-facing or serve guest or office traffic.
- Replace or decommission the devices as a priority, since no patch will be released.
- Until replacement, isolate the devices from the internet and restrict management access.
- Monitor the NVD and VulDB entries and the TRENDnet announcements for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry CVE-2026-109157 vuldb.com
- VulDB vulnerability 416890 vuldb.com
- Researcher write-up (GitHub) github.com
- TRENDnet support announcements www.trendnet.com
- Positive Technologies advisory PT-2026-116536 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:35.
Original description (NVD)
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.