{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-10162/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-10162"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TEW-432BRP 3.10B20"],"_cs_severities":["critical"],"_cs_tags":["stack-based-buffer-overflow","rce","cve-2026-10162"],"_cs_type":"advisory","_cs_vendors":["TRENDnet"],"content_html":"\u003cp\u003eA stack-based buffer overflow vulnerability, identified as CVE-2026-10162, has been discovered in TRENDnet TEW-432BRP router, version 3.10B20. This flaw resides within the \u003ccode\u003eformSetPassword\u003c/code\u003e function of the \u003ccode\u003e/goform/formSetPassword\u003c/code\u003e file. An unauthenticated, remote attacker can exploit this vulnerability by crafting a malicious HTTP request containing an overly long \u003ccode\u003ewebpage\u003c/code\u003e argument. Successful exploitation allows the attacker to overwrite parts of the stack, leading to arbitrary code execution on the device. The vendor has stated that the product has been end-of-life (EOL) since 2009 and will not be providing a patch, which increases the risk for users who are still operating this device. The exploit has been published, increasing the likelihood of exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a TRENDnet TEW-432BRP router version 3.10B20 exposed to the internet.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/goform/formSetPassword\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes the \u003ccode\u003ewebpage\u003c/code\u003e parameter with a value exceeding the expected buffer size.\u003c/li\u003e\n\u003cli\u003eThe router's web server processes the request and passes the \u003ccode\u003ewebpage\u003c/code\u003e parameter to the \u003ccode\u003eformSetPassword\u003c/code\u003e function without proper bounds checking.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eformSetPassword\u003c/code\u003e function copies the oversized \u003ccode\u003ewebpage\u003c/code\u003e argument onto the stack, overflowing the allocated buffer.\u003c/li\u003e\n\u003cli\u003eThe overflow overwrites adjacent memory on the stack, including the return address of the function.\u003c/li\u003e\n\u003cli\u003eThe function returns, but instead of returning to the caller, it jumps to an address controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker injects shellcode into the overflowed buffer and redirects execution to this shellcode, gaining remote code execution on the device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code on the TRENDnet TEW-432BRP router. This can lead to a complete compromise of the device, including unauthorized access to network resources, modification of router settings, and potential use of the device as a botnet node. Given the age of the affected device and its end-of-life status, impacted users are unlikely to receive patches and remain vulnerable until the device is replaced or removed from service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect CVE-2026-10162 Exploitation Attempt\u003c/code\u003e to detect attempts to exploit this vulnerability based on the URI and method.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect CVE-2026-10162 Stack Buffer Overflow in TRENDnet Router\u003c/code\u003e to detect overly long values for the webpage parameter.\u003c/li\u003e\n\u003cli\u003eGiven the EOL status of TRENDnet TEW-432BRP 3.10B20, replace affected devices immediately.\u003c/li\u003e\n\u003cli\u003eIf device replacement is not possible, isolate the device from the network and restrict access to prevent potential exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-31T03:20:53Z","date_published":"2026-05-31T03:20:53Z","id":"https://feed.craftedsignal.io/briefs/2026-05-31-trendnet-stack-overflow/","summary":"A stack-based buffer overflow vulnerability (CVE-2026-10162) exists in the formSetPassword function of TRENDnet TEW-432BRP version 3.10B20, allowing a remote attacker to execute arbitrary code by manipulating the webpage argument in the /goform/formSetPassword file.","title":"TRENDnet TEW-432BRP Stack-Based Buffer Overflow Vulnerability (CVE-2026-10162)","url":"https://feed.craftedsignal.io/briefs/2026-05-31-trendnet-stack-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-10162","version":"https://jsonfeed.org/version/1.1"}