CVE-2026-10063: TRENDnet TEW-432BRP Stack Overflow – End-of-Life Router Vulnerability

Technical summary

The vulnerability exists in the formWPS function accessed via the /goform/formWPS endpoint. An authenticated attacker can supply an oversized value in the peerPin parameter, causing a stack-based buffer overflow (CWE-121). This memory corruption occurs in a remotely accessible web interface function and bypasses authentication only in the sense that the WPS page itself may be accessible depending on network configuration. The flaw maps to CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow). Public exploit code is available, lowering the barrier to exploitation.

Business impact

Organizations running this legacy hardware as part of network infrastructure face a material but time-limited risk. While the router is obsolete, it may still be deployed in remote offices, branch locations, or disconnected networks where refresh cycles are extended. A successful attack could result in temporary denial of service (device crash) or, in worst case, code execution allowing an attacker inside the network perimeter to pivot to higher-value targets. The lack of vendor support means vulnerability management relies entirely on network segmentation and access controls rather than patching.

Affected systems

The TEW-432BRP router in firmware version 3.10B20 is the confirmed affected hardware. No patches will be released by TRENDnet. Any deployment of this device should be considered vulnerable unless mitigated through network architecture (e.g., isolation, firewall rules restricting access to the web interface, or device replacement).

Exploitability

Exploitation requires network access to the router's web interface and valid credentials to authenticate to the device. Public exploit code is available, which increases the practical risk of opportunistic attacks in environments where the router is internet-facing or accessible to untrusted network segments. The attack is straightforward once authentication is achieved, making it a concern for any administrator unable to decommission the hardware promptly. The CVSS score of 8.8 (HIGH) reflects the combination of high impact and relatively easy exploitation for a remote, authenticated attacker.

Remediation

The most effective mitigation is hardware replacement with a supported, current-generation router. If immediate replacement is not feasible, isolate the affected router from external and untrusted network access via firewall rules, VLANs, or network segmentation. Restrict access to the web interface (typically port 80/443) to only trusted administrators and administrative subnets. Monitor for unusual access patterns or crashes that might indicate exploitation attempts. Disable WPS if the feature is not required, though the underlying buffer overflow in the formWPS function remains a concern if the interface is accessible.

Patch guidance

No patches will be issued by TRENDnet, as confirmed by the vendor. Firmware version 3.10B20 is the final release for this device. Any organization still running this hardware must accept the vulnerability as unfixable at the code level and rely on compensating controls (network isolation, access restrictions, and hardware replacement planning) to manage risk.

Detection guidance

Monitor HTTP access logs for POST requests to /goform/formWPS with unusually large peerPin parameters. Set up IDS/IPS signatures to detect oversized parameters in WPS configuration requests if the router is accessible over networks you control. Application-level monitoring may detect device crashes or reboots occurring after such requests. Network flows to the router's web interface from unexpected sources should trigger investigation. Given the age of the hardware, any active management traffic to it warrants review against your current inventory to ensure it is still intentionally deployed.

Why prioritize this

Despite the HIGH CVSS score, this vulnerability affects only a router that has been unsupported for 15+ years. Prioritization should be based on organizational inventory: if the device is still in production, it should be flagged for urgent replacement and network isolation. If it has already been decommissioned, no action is needed. The presence of public exploit code and the feasibility of exploitation for authenticated attackers mean that any active deployment should be treated as a near-term security gap requiring compensating controls or replacement.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a HIGH severity rating driven by network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. The primary mitigating factor is the requirement for prior authentication (PR:L). For an organization, the real-world risk depends entirely on whether the device is still in use and how it is positioned in the network. A device fully isolated from untrusted segments and managed only by authorized administrators carries lower practical risk than one with broad accessibility.

Frequently asked questions