Which versions of TRENDnet TEW-432BRP are affected by CVE-2026-10159?

The TRENDnet TEW-432BRP wireless router firmware 3.10B20 contains a memory corruption vulnerability exploitable via authenticated remote access, with publicly available exploit code documented.

Is there a public PoC exploit available for CVE-2026-10159?

Yes, a public proof-of-concept exploit is available for CVE-2026-10159. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10159?

Within 24 hours: conduct network inventory to identify active TEW-432BRP devices and document firmware versions. Within 7 days: implement network segmentation and firewall rules blocking external access to the /goform/formSysLog endpoint and restricting administrative access. Within 30 days: complete hardware replacement plan with current-generation, vendor-supported wireless router equipment.

TRENDnet TEW-432BRP CVE-2026-10159

Q: What is the CVSS score of CVE-2026-10159?

CVE-2026-10159 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33478 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-93f4-pc5c-hr94

Buffer Overflow Stack Overflow Tew 432Brp

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 02:28 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 02:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 02:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 02:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 31, 2026 - 01:41 vuln.today

DescriptionCVE.org

A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSysLog of the file /goform/formSysLog. This manipulation of the argument current_page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router (firmware 3.10B20) allows authenticated remote attackers to corrupt memory via the current_page parameter handled by the formSysLog function at /goform/formSysLog, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists, and the vendor has explicitly declined to issue a fix because the product has been end-of-life since 2009. Affected deployments are unsupported legacy hardware with no remediation path other than replacement.

Technical ContextAI

The vulnerability resides in the embedded HTTP administration interface (goform CGI handler) commonly found in older SoHo router firmware, where user-supplied query/POST parameters are copied into fixed-size stack buffers without proper bounds checking. CWE-121 (Stack-based Buffer Overflow) in the formSysLog handler means the current_page argument overflows a local buffer, corrupting saved return addresses and frame state on the MIPS/ARM stack typical of these devices. The affected CPE cpe:2.3:a:trendnet:tew-432brp:*:* indicates all firmware revisions of this TEW-432BRP 4-port wireless N router model are within scope, and the lack of stack canaries, ASLR, or NX in such legacy firmware makes exploitation considerably easier than on modern systems.

RemediationAI

No vendor-released patch identified at time of analysis - TRENDnet has publicly declined to investigate or fix the issue because the TEW-432BRP has been end-of-life since 2009, so the only durable remediation is decommissioning and replacing the device with a currently supported router. As compensating controls until replacement, disable remote (WAN-side) administration on the router so /goform/formSysLog is not reachable from the internet, restrict LAN-side access to the web admin interface to a dedicated management VLAN or specific source IPs, change any default administrator credentials to long random values to raise the bar for the PR:L precondition, and place the device behind an upstream firewall that blocks inbound HTTP/HTTPS to its management port; note these controls do not stop an attacker who already has LAN foothold or valid admin creds. Reference the public details at https://vuldb.com/vuln/367412 when prioritizing replacement.