CVE-2026-15480
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability was found in Trendnet TEW-635BRM up to version 1.00.03 in the start_httpd function of the /sbin/rc file within the Web Service component. Manipulating the device_name argument causes a stack-based buffer overflow, allowing remote exploitation. The vendor does not confirm the issue and states the device has been end-of-life since 2011.
Risk Assessment
The risk for the organization is the potential for remote code execution on an unsupported network device, which could compromise the confidentiality and integrity of data on the local network.
Recommendation
It is recommended to immediately decommission all Trendnet TEW-635BRM devices and replace them with newer, supported models. Do not rely on patches as the product is end-of-life.
Other vulnerabilities in Trendnet TEW-635BRM
Original NVD description (English source)
A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument device_name leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer.