CVE-2026-10064: TRENDnet TEW-432BRP Stack Overflow – Unpatched EOL Router Vulnerability

Technical summary

CVE-2026-10064 is a stack-based buffer overflow (CWE-119, CWE-121) in the formSetPortTr function of the TRENDnet TEW-432BRP router. The vulnerability exists in the /goform/formSetPortTr endpoint, where the special_name parameter is not properly validated before being written to the stack. This allows an authenticated user to overflow a fixed-size buffer and overwrite adjacent stack memory, potentially hijacking program execution. The attack vector is network-based and requires valid credentials but no user interaction.

Business impact

Organizations still operating TEW-432BRP devices face a significant security gap. While the CVSS score of 6.3 (Medium) reflects the need for authentication, the combination of remote exploitability, public proof-of-concept code, and zero vendor support creates a practical security risk. Affected devices cannot receive patches and should be treated as legacy infrastructure requiring network isolation or replacement.

Affected systems

The vulnerability affects TRENDnet TEW-432BRP wireless routers running firmware version 3.10B20 and likely all earlier versions. This is an end-of-life consumer/small-business router released around 2009. Only organizations that have retained these devices in production environments are at risk; however, older networks or branch offices may unknowingly still be running this hardware.

Exploitability

The vulnerability requires authentication (login credentials), which provides a baseline control but is not difficult for attackers with network access to overcome. Public exploit code is available, reducing the barrier to weaponization. The attack is remote, has low complexity, and requires no user interaction once an attacker is authenticated. The availability of functional exploits and the complete lack of patches make this a material exploitability concern for exposed instances.

Remediation

Immediate remediation requires decommissioning the affected device or physically isolating it from untrusted networks. As TRENDnet has confirmed no patches will be released, upgrading to a current, supported wireless router is the only permanent solution. Organizations should audit their network inventory to identify any remaining TEW-432BRP units and develop a replacement timeline. Interim mitigation includes disabling remote management, restricting access via firewall rules, and changing default credentials to strong values.

Patch guidance

No patches are available from TRENDnet. The vendor explicitly stated the product has been unsupported since 2009 and will not issue updates. Organizations cannot rely on patching and must treat replacement or network isolation as the only viable remediation path. Verify your device firmware version in the administrative interface; if it is TEW-432BRP firmware 3.10B20 or earlier, plan for device retirement.

Detection guidance

Monitor network traffic for HTTP POST requests to /goform/formSetPortTr endpoints on internal IP ranges. Look for unusual parameter values in the special_name field, particularly those containing unexpected binary data or abnormally long strings that may indicate buffer overflow attempts. Logging from affected routers (if available) may show failed authentication followed by repeated requests to this endpoint. Endpoint Detection and Response (EDR) tools on systems that might connect through affected routers should alert on unexpected privilege escalation or process spawning by router management services.

Why prioritize this

Despite its Medium CVSS score, this vulnerability merits immediate attention because: (1) exploit code is publicly available, (2) no patches exist and none will be issued, (3) the device is likely forgotten in production rather than actively managed, and (4) compromise of network infrastructure can serve as a pivot point for lateral movement. Age and obsolescence increase risk in this case rather than reducing it—security debt that has accumulated over 15+ years without updates.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects authentication requirements and limited scope, but underweights the practical risk posed by zero vendor support and public exploits. For risk prioritization, treat this as higher priority than the base score suggests: the device cannot be patched, exploit tools exist, and a compromised router is a critical asset for network reconnaissance and lateral movement.

Frequently asked questions