TRENDnet TEW-432BRP CVE-2026-10121

Exploitation requires network reachability to the device's HTTP administration interface (LAN by default, or WAN where the legacy remote-management feature is enabled) and a valid authenticated session to the web UI per CVSS PR:L - in practice this is a weak barrier on TEW-432BRP units because factory default admin/admin credentials are commonly retained. The specific vulnerable code path is the URL-filtering handler at /goform/formSetUrlFilter, reached by submitting the keyword_list or keyword parameters, so the URL-filter/parental-control feature must be present in the firmware (it is, in 3.10B20). Limiting factors: the vulnerability is confined to firmware 3.10B20 of the TEW-432BRP specifically, no user interaction is required (UI:N), and CVSS scope is unchanged so impact is bounded to the router itself rather than chaining into adjacent systems.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low privileges (an authenticated session to the router web UI) with high impact on confidentiality, integrity, and availability of the device itself; the unchanged subsequent-system metrics (SC:N/SI:N/SA:N) limit blast radius to the router. E:P confirms that proof-of-concept code is public, which is corroborated by the GitHub reference. There is no EPSS score, no SSVC decision, and no CISA KEV entry provided, so widespread automated exploitation cannot be asserted - but the PR:L requirement is weak in practice because TEW-432BRP units commonly retain factory-default admin credentials (admin/admin) and have historically been exposed via remote management, which effectively collapses the authentication barrier. The most important real-world signal is the vendor's explicit refusal to patch: this CVE will never be remediated upstream, so any remaining deployed device is a permanent liability rather than a transient one.

An attacker who has obtained or guessed router admin credentials - trivially common on this EOL device since factory defaults like admin/admin were rarely changed - reaches the web UI either over the LAN or, where remote management is enabled, across the internet, and POSTs an over-long keyword_list or keyword value to /goform/formSetUrlFilter. The oversized parameter overflows a stack buffer in the embedded web daemon running as root, and using the published PoC technique the attacker overwrites the return address to gain code execution on the router, enabling persistent DNS hijacking, traffic interception, or use of the device as a residential proxy.