Stack-Based Buffer Overflow in Trendnet TEW-635BRM

Executive Summary

CVE-2026-15480 is a stack-based buffer overflow vulnerability in the TRENDnet TEW-635BRM router, specifically in the start_httpd function of the /sbin/rc binary. The issue arises because the device_name variable from NVRAM is copied into a fixed-size stack buffer without checking its length, using the unsafe strcpy() function.

Since the buffer is only 126 bytes but the saved return address is located 136 bytes below it, any device_name longer than 136 bytes will overwrite the return address, causing a crash and preventing the web service from starting.

An attacker with write access to NVRAM can exploit this by setting a maliciously crafted device_name, potentially leading to remote code execution. The exploit can be triggered manually or automatically at boot.

Mitigation involves replacing strcpy with safer functions like strncpy or strlcpy and enforcing input length validation at the NVRAM storage layer.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with write access to the device's NVRAM to execute arbitrary code remotely by exploiting the buffer overflow in the device_name parameter.

Successful exploitation can cause the web service to crash or be prevented from starting, potentially leading to denial of service or full compromise of the device.

Since the device is no longer supported and the exploit is publicly available, users are at increased risk if they continue to use this device.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the device's NVRAM variable "device_name" contains a value longer than 136 bytes, which causes a stack-based buffer overflow in the /sbin/rc binary's start_httpd function.

One way to test for the vulnerability is to manually trigger the vulnerable service using the command:

• rc service start

If the web service (mini_httpd) fails to start or crashes, it may indicate the presence of the vulnerability due to a buffer overflow caused by an oversized device_name.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of devices affected by this vulnerability, as the product is end-of-life and no official patches are available.

If continued use is necessary, ensure that the device_name NVRAM variable is not set to a value longer than 136 bytes to prevent triggering the buffer overflow.

From a development or maintenance perspective, replacing unsafe functions like strcpy with safer alternatives such as strncpy or strlcpy and enforcing input length validation at the NVRAM storage layer are recommended to prevent oversized values.

Ultimately, the vendor recommends switching to supported devices due to the lack of official fixes.

Useful 0 Not Useful 0