The vulnerability CVE-2026-10160 affects TRENDnet TEW-432BRP version 3.10B20. It is a stack-based buffer overflow in the /goform/formSetEnableWizard endpoint, specifically in the formSetEnableWizard function. An attacker can remotely exploit this by manipulating the start_wizard argument, potentially leading to code execution or denial of service. The device is no longer supported by the vendor, who has explicitly stated no fix will be provided. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the high CVSS score and the nature of a stack-based buffer overflow, the impact on confidentiality, integrity, and availability is high. However, the affected product is end-of-life and no longer supported, which means the vulnerability will remain unpatched and devices in use remain at risk.

The vendor has stated that the product has been end-of-life since 2009 and they will not provide a fix or replicate the vulnerability. No official patch or remediation is available. Users should consider discontinuing use of the affected device and replacing it with a supported model. Network-level protections such as firewall rules to restrict access to the device's management interface may help reduce exposure, but no vendor-supported mitigation exists.