TRENDnet TEW-432BRP CVE-2026-10160

Exploitation requires network reachability to the TEW-432BRP web administration interface (typically TCP/80 on the LAN side, or WAN-side if remote management was enabled) and valid administrator credentials to satisfy the CVSS PR:L requirement - the formSetEnableWizard handler sits behind the authenticated admin UI. No user interaction beyond the attacker's own authenticated session is needed (UI:N). Limiting factors: only the TEW-432BRP running firmware 3.10B20 (and likely sibling revisions on the same hardware) is in scope; the device has been EOL since 2009, so the realistic exposed population is small and skewed toward neglected deployments; PR:L means a password change or disabled default credentials materially reduces practical exploitability, though weak/default credentials are common on this device class.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low privileges (an authenticated session to the router's web UI) with full confidentiality, integrity, and availability impact on the device. Threat-intel signals are mixed: a public PoC is published on GitHub (E:P in the vector confirms 'Proof-of-Concept' maturity), but the CVE is not in CISA KEV and no EPSS score was supplied, which is consistent with limited mass-exploitation interest in a 15-year-EOL consumer router. The real-world risk is concentrated rather than widespread - the population of internet-exposed TEW-432BRPs is small, but for each remaining unit the risk is effectively permanent because the vendor has explicitly refused to patch. The PR:L requirement is a meaningful limiter; however, default/weak admin credentials and CSRF chaining are common on devices of this vintage and should be assumed in threat modeling.

An attacker who has obtained or guessed the router's admin password (or who chains this with a CSRF on an authenticated admin's browser) sends a single crafted HTTP POST to /goform/formSetEnableWizard with an oversized start_wizard value, overflowing the stack buffer and either crashing the device or, using the published PoC as a template, redirecting execution to attacker-controlled shellcode. A successful exploit yields full control of the router, enabling DNS hijacking, traffic interception, pivoting into the LAN, or enrolling the device into a botnet. Public PoC code is available on GitHub, lowering the skill barrier significantly.