CVE-2026-109157: Stack-based Buffer Overflow in TRENDnet TEW-432BRP
Description
CVE-2026-109157 is a critical stack-based buffer overflow vulnerability in the TRENDnet TEW-432BRP router version 3.10B20. The flaw exists in the formTcpipSetup function, where manipulation of the Name argument can cause a buffer overflow. This vulnerability can be exploited remotely. The vendor has declared the product end-of-life since 2011 and does not provide a patch or official fix. Exploit code has been made public, but no known active exploitation is reported.
CVSS v4.0
Score 9.4critical
Affected software
TRENDnet
TEW-432BRP
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-109157 affects TRENDnet TEW-432BRP version 3.10B20. It is a stack-based buffer overflow in the formTcpipSetup function of the /goform/formTcpipSetup endpoint. An attacker can remotely trigger this by manipulating the Name argument, potentially leading to remote code execution or denial of service. The vendor has confirmed the product is end-of-life and no testing or patching is available. Public exploit code exists, increasing the risk of exploitation despite no known in-the-wild attacks.
Potential Impact
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to cause a stack-based buffer overflow, potentially leading to remote code execution or denial of service on the affected router. Given the critical CVSS score of 9.4, the impact is severe. However, the affected product is no longer supported and no patch is available.
Mitigation Recommendations
No official fix or patch is available as the product reached end-of-life in 2011. Users should consider replacing the affected TRENDnet TEW-432BRP routers with supported devices. Network-level mitigations such as restricting access to the device's management interface from untrusted networks may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-12T12:00:50.049Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace102b2cdf04f656550a3f
Added to database: 10/13/2026, 11:04:11 UTC
Last enriched: 10/13/2026, 11:18:16 UTC
Last updated: 10/13/2026, 11:19:23 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.