CVE-2026-10121: TRENDnet TEW-432BRP Stack Buffer Overflow

Technical summary

CVE-2026-10121 is a stack-based buffer overflow in the formSetUrlFilter function accessible via the /goform/formSetUrlFilter endpoint. The vulnerability stems from insufficient bounds checking on the keyword_list or keyword parameter, allowing an authenticated attacker to overflow the stack and corrupt memory. This affects TRENDnet TEW-432BRP firmware 3.10B20. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), both indicating memory safety issues. Exploitation requires valid credentials (PR:L per CVSS vector), though the attack is network-accessible and does not require user interaction.

Business impact

Organizations running legacy TRENDnet TEW-432BRP routers face potential network disruption and unauthorized access. A successful exploit could render affected routers inoperable or allow an authenticated insider to gain full device control, potentially compromising network segmentation or enabling lateral movement. Since the product has been unsupported since 2009, no vendor patches will be released. Organizations still relying on this hardware should treat it as inherently unmanageable from a security perspective and plan for replacement or isolation.

Affected systems

The vulnerability impacts TRENDnet TEW-432BRP devices running firmware 3.10B20. This consumer-grade wireless router model has been out of support for 15 years. Any organization or network still operating this equipment is affected if it remains reachable by authenticated users or network segments.

Exploitability

Proof-of-concept exploit code has been published, increasing practical exploitability. The attack requires valid credentials, which limits exposure in air-gapped or tightly controlled environments but raises risk in networks with multiple user accounts or where credentials have been compromised. The CVSS score of 8.8 reflects high impact—confidentiality, integrity, and availability are all threatened—combined with network accessibility and minimal attack complexity. This is a straightforward memory safety bug that skilled attackers can weaponize without significant effort.

Remediation

No patches are available from TRENDnet. Organizations should immediately remove or isolate any TEW-432BRP routers from production networks. Replace affected devices with currently supported hardware from the vendor or alternative manufacturers. If replacement is not immediately feasible, segment these routers to a separate management network with strict access controls, disable remote administration features, and restrict credential access. Monitor these devices closely for unauthorized access attempts.

Patch guidance

Vendor has explicitly stated this product will not receive updates. Do not wait for a patch. Initiate a hardware replacement program immediately. If the device cannot be removed, place it behind additional network controls: restrict administrative access to specific IP ranges, disable any remote management features, change all default credentials to strong values, and consider it a liability rather than a controlled asset. Verify all affected devices in your environment and document their business justification for retention.

Detection guidance

Monitor network logs for POST requests to /goform/formSetUrlFilter with unusually large or malformed keyword_list parameters. Implement network segmentation to isolate these devices and trigger alerts if they receive inbound traffic from unexpected sources. Review device logs for failed or successful authentication attempts, particularly during off-hours. Search asset inventory systems for TEW-432BRP models and cross-reference with active network monitoring to identify instances still in use. Consider these devices unmonitorable in a defense-in-depth sense and prioritize their removal.

Why prioritize this

While the CVSS score is high (8.8), practical urgency is tempered by the fact that this hardware is 15+ years old and likely rare in modern deployments. Organizations that do operate this equipment should treat replacement as a planned infrastructure upgrade rather than an emergency. However, if any TEW-432BRP routers are discovered in use, they represent unpatched, unsupported attack surface and should be removed within your next maintenance window. The publication of exploit code elevates risk for any instance that remains.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the severity of the vulnerability itself: network-accessible, low attack complexity, memory corruption with full system compromise potential (C:H/I:H/A:H). However, real-world risk is contextual. Deployment in an isolated network or air-gapped environment significantly reduces exposure. Deployment in an internet-facing or multi-user network dramatically increases it. The lack of vendor support means this risk will never be addressed through patching and must be managed through containment or removal.

Frequently asked questions