CVE-2026-10062
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP firmware version 3.10B20, specifically in the formSetRoute function of the /goform/formSetRoute file. An attacker can remotely manipulate the ip/mask/gateway arguments to trigger the overflow. The exploit has been publicly disclosed and may be used.
Risk Assessment
The risk for the organization includes potential remote code execution or device crash, which could compromise network integrity. The vendor no longer provides support or patches as the product has been end-of-life since 2009.
Recommendation
It is recommended to immediately retire TRENDnet TEW-432BRP devices and replace them with newer, supported models. If replacement is not possible, isolate these devices from the production network and apply strict firewall rules.
Other vulnerabilities in TRENDnet TEW-432BRP
See all- CVE-2026-10061Medium
A command injection vulnerability was found in TRENDnet TEW-432BRP firmware 3.10B20 in the formWPS function of /goform/formWPS. Manipulating the peerPin argument allows remote command execution. The vendor states the product has been end-of-life for 15 years and will not be patched.
- CVE-2026-10060Medium
A command injection vulnerability was discovered in TRENDnet TEW-432BRP firmware version 3.10B20. The flaw exists in the formSetRoute function within /goform/formSetRoute, where the ip, mask, and gateway parameters are not properly sanitized. The vendor states the product has been end-of-life for 15 years and will not provide fixes.
- CVE-2026-10183High
A stack-based buffer overflow was identified in TRENDnet TEW-432BRP version 3.10B20 in the formWlanSetup function of the /goform/formWlanSetup file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
- CVE-2026-10182Medium
TRENDnet TEW-432BRP router version 3.10B20 has a command injection vulnerability in the formWlanSetup function. Manipulating the enrollee argument allows remote command execution. The product has been EOL for 15 years and no patch will be released.
- CVE-2026-10181High
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSysCmd function of the /goform/formSysCmd file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
- CVE-2026-10180Medium
TRENDnet TEW-432BRP router version 3.10B20 has a command injection vulnerability in the formSysCmd function. Manipulating the sysCmd argument allows remote command execution. The product has been EOL for 15 years and no patch will be released.
- CVE-2026-10179High
In the TRENDnet TEW-432BRP router version 3.10B20, the function formSetWlanEncrypt in /goform/formSetWlanEncrypt is vulnerable to stack-based buffer overflow via the webpage argument. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product is EOL since 2009 and will not be fixed.
- CVE-2026-10162High
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSetPassword function of the /goform/formSetPassword file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
- CVE-2026-10161High
A stack-based buffer overflow was detected in TRENDnet TEW-432BRP version 3.10B20 in the formResetStatistic function of the /goform/formResetStatistic file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
- CVE-2026-10160High
A stack-based buffer overflow was found in TRENDnet TEW-432BRP version 3.10B20 in the formSetEnableWizard function of the /goform/formSetEnableWizard file. The attack can be launched remotely, and the exploit is publicly available. The vendor states the product has been EOL for 15 years.
Original NVD description (English source)
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.