TRENDnet TEW-432BRP CVE-2026-10064

Exploitation requires the attacker to hold a low-privilege authenticated session on the TEW-432BRP web management interface (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not indicated by available data. The vulnerable endpoint /goform/formSetPortTr must be reachable over the network, meaning the device's HTTP management interface must be accessible to the attacker, either via LAN, WLAN, or internet-exposed remote management. The specific vulnerable parameter is special_name in the port-triggering form. Limiting factors: authentication (even low-privilege) is required; the device must be running firmware version 3.10B20; and the attack is constrained to devices reachable on the network. The requirement for any authentication - however minimal - limits fully automated or unauthenticated internet-wide scanning attacks, but credentials for SOHO routers are frequently default or weak.

The CVSS 4.0 base score of 2.1 is strikingly low for a network-reachable stack-based buffer overflow with a public proof-of-concept. The low score is driven by the impact metrics being set to Low across all confidentiality, integrity, and availability dimensions (VC:L/VI:L/VA:L), with no subsequent system impact (SC:N/SI:N/SA:N). This scoring appears inconsistent with typical stack overflow outcomes on 2009-era router firmware, where memory protections are absent and full device compromise is a realistic result - defenders should treat this as potentially underscored. The attack vector is network (AV:N) with low complexity (AC:L) and no additional attack requirements (AT:N), but PR:L means some level of authenticated access is required, which limits opportunistic exploitation. The exploit-maturity modifier E:P confirms public PoC code exists, elevating practical risk. No EPSS score was provided. CISA KEV status is absent, indicating no confirmed mass exploitation at time of analysis. The most significant risk signal here is the combination of public PoC and a permanent no-patch status on a device likely still deployed in legacy home and small-business environments.

An attacker with low-privilege credentials to the router's web management interface - for example, a guest account or a secondary administrator - sends a crafted HTTP POST request to /goform/formSetPortTr with an oversized value in the special_name parameter. On the 2009-era firmware lacking stack canaries or ASLR, the overflow overwrites the saved return address, redirecting execution to attacker-controlled code and achieving full router compromise. A public proof-of-concept demonstrating this technique is available on GitHub, lowering the technical barrier for exploitation.