CVE-2026-109157
Received Received - Intake

Stack-Based Buffer Overflow in TRENDnet TEW-432BRP

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109157
EUVD
EUVD-2026-98453

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TRENDnet TEW-432BRP 3.10B20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware. It occurs in the formTcpipSetup function when processing the Name argument. The flaw allows an attacker to send a specially crafted POST request with an excessively long Name value, causing a buffer overflow that overwrites the return address on the stack. This leads to a crash and potential remote code execution.

Detection Guidance

Detect this vulnerability by sending a crafted POST request to /goform/formTcpipSetup with an excessively long 'name' parameter. Use curl to test: curl -X POST -d 'name=<long_string_of_a>' http://<router_ip>/goform/formTcpipSetup. If the router crashes or becomes unresponsive, it may be vulnerable.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to crash the router or execute arbitrary code. This would disrupt network services, potentially causing internet outages or unauthorized access to the router. Since the device is end-of-life and unsupported, no official patches are available.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by exposing sensitive network configurations or enabling unauthorized access to router settings. A stack-based buffer overflow may allow attackers to manipulate router behavior, leading to data breaches or service disruptions. However, since the affected product (TRENDnet TEW-432BRP) reached end-of-life in 2011 and lacks vendor support, maintaining compliance may be challenging due to unpatched security flaws.

Mitigation Strategies

Since the product is end-of-life (EOL) and unsupported, the vendor recommends notifying users of the potential risk. Immediate mitigation includes isolating the device from critical networks, disabling remote access, and replacing the device with a supported model. Input validation cannot be applied as the vendor no longer provides updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart