Remote Stack-Based Buffer Overflow in TRENDnet TEW-432BRP

The TRENDnet TEW-432BRP router (version 3.10B20) contains a critical stack-based buffer overflow vulnerability identified as CVE-2026-109157. The vulnerability exists within the 'formTcpipSetup' function, which fails to properly validate the 'Name' argument when processing requests sent to the '/goform/formTcpipSetup' endpoint. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted HTTP request to the device, potentially leading to remote code execution. Public exploit code for this vulnerability is available, increasing the risk of exploitation. TRENDnet has confirmed that this device reached end-of-life (EOL) in 2011 and will not receive official security patches, leaving deployed units permanently vulnerable.

Impact

Successful exploitation allows for unauthenticated remote code execution on the target router. This provides attackers with full control over the network gateway, enabling traffic interception, man-in-the-middle attacks, and internal network reconnaissance. Given the EOL status, there is no path to remediation, and organizations must isolate or replace affected hardware to mitigate the risk of compromise.

Recommendation

Prioritize the decommissioning and replacement of all identified TRENDnet TEW-432BRP routers as no patches exist for this device. Implement network segmentation to isolate legacy networking hardware from production environments. Utilize network-based intrusion detection systems to monitor for anomalous HTTP requests targeting the '/goform/formTcpipSetup' URI.