TRENDnet TEW-432BRP CVE-2026-10120

Exploitation requires network reachability to the router's HTTP administration interface and valid low-privilege credentials to the web UI (CVSS PR:L) in order to reach the /goform/formSetFirewallRule handler; the attacker then supplies an oversized value in the firewall_name POST parameter to trigger the stack overflow. Practical limiting factors: the management interface must be reachable from the attacker (LAN-side by default, WAN-side only if remote administration is explicitly enabled), and the attacker must possess or guess a valid admin credential - though on a 2009-era EOL SOHO router the default admin/admin remaining unchanged is common. No user interaction is required (UI:N), and the only affected firmware/hardware is TRENDnet TEW-432BRP at firmware 3.10B20 (and likely all prior revisions, given the product is unsupported).

Signals are mixed but lean toward genuine operational risk for any organization still running this hardware. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates remote, low-complexity exploitation requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the device - yielding a score of 7.4. Exploit maturity is marked Proof-of-Concept (E:P) and a working PoC is published on GitHub, raising practical attacker capability above the baseline. The CVE is NOT listed in CISA KEV and no EPSS score was provided, so widespread mass-exploitation cannot be confirmed; however, the PR:L requirement (a valid web-UI credential, often the default admin/admin on EOL SOHO gear) is a low bar in practice. The decisive aggravating factor is the vendor's explicit refusal to patch - risk is effectively permanent until the device is decommissioned. Caveat: the CVSS vector requires PR:L (authentication) but the description says only that the attack 'can be executed remotely' without clarifying credential prerequisites; defenders should verify whether the firewall_name endpoint truly enforces authentication on this firmware.

An attacker who can reach the router's web interface (either across the internet if remote admin is enabled, or from the LAN/WLAN after associating with the network) authenticates with valid or default credentials and submits a crafted POST to /goform/formSetFirewallRule containing an oversized firewall_name value. The overflow corrupts the stack and, using the published PoC as a template, the attacker gains arbitrary code execution as the web-server process (typically root on these embedded devices), enabling persistent backdoor installation, DNS hijacking, or pivoting onto the internal network.