CVE-2026-10123: Stack-based Buffer Overflow in TRENDnet TEW-432BRP
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetDomainFilter of the file /goform/formSetDomainFilter. Performing a manipulation of the argument blocked_domain/permitted_domain/blocked_domain_list/permitted_domain_list results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
AI Analysis
Technical Summary
The vulnerability CVE-2026-10123 affects TRENDnet TEW-432BRP version 3.10B20. It is a stack-based buffer overflow triggered by manipulating the blocked_domain, permitted_domain, blocked_domain_list, or permitted_domain_list arguments in the formSetDomainFilter function located at /goform/formSetDomainFilter. This flaw allows remote attackers to potentially execute arbitrary code or cause denial of service. The product is no longer supported by TRENDnet, which has explicitly stated they will not fix or replicate the vulnerability due to the product's end-of-life status since 2009. No patch or official remediation exists.
Potential Impact
Successful exploitation of this vulnerability could lead to remote code execution or denial of service on the affected device. Given the high CVSS score of 8.7, the impact is significant. However, since the device is end-of-life and unsupported, users cannot obtain an official fix from the vendor. The exploit code has been publicly disclosed, increasing the risk of exploitation in environments where this legacy device remains in use.
Mitigation Recommendations
No official patch or fix is available from the vendor due to the product's end-of-life status. The vendor has stated they will not address this vulnerability. Mitigation options include discontinuing use of the affected device and replacing it with a supported product. Network segmentation or firewall rules could be used to limit remote access to the device's management interfaces to reduce exposure. Patch status is not applicable as no fix exists.
CVE-2026-10123: Stack-based Buffer Overflow in TRENDnet TEW-432BRP
Description
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetDomainFilter of the file /goform/formSetDomainFilter. Performing a manipulation of the argument blocked_domain/permitted_domain/blocked_domain_list/permitted_domain_list results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-10123 affects TRENDnet TEW-432BRP version 3.10B20. It is a stack-based buffer overflow triggered by manipulating the blocked_domain, permitted_domain, blocked_domain_list, or permitted_domain_list arguments in the formSetDomainFilter function located at /goform/formSetDomainFilter. This flaw allows remote attackers to potentially execute arbitrary code or cause denial of service. The product is no longer supported by TRENDnet, which has explicitly stated they will not fix or replicate the vulnerability due to the product's end-of-life status since 2009. No patch or official remediation exists.
Potential Impact
Successful exploitation of this vulnerability could lead to remote code execution or denial of service on the affected device. Given the high CVSS score of 8.7, the impact is significant. However, since the device is end-of-life and unsupported, users cannot obtain an official fix from the vendor. The exploit code has been publicly disclosed, increasing the risk of exploitation in environments where this legacy device remains in use.
Mitigation Recommendations
No official patch or fix is available from the vendor due to the product's end-of-life status. The vendor has stated they will not address this vulnerability. Mitigation options include discontinuing use of the affected device and replacing it with a supported product. Network segmentation or firewall rules could be used to limit remote access to the device's management interfaces to reduce exposure. Patch status is not applicable as no fix exists.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-29T17:19:29.210Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1b06d4e29bf47b50425a3d
Added to database: 05/30/2026, 15:48:36 UTC
Last enriched: 06/06/2026, 20:59:41 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.