Which versions of TRENDnet TEW-432BRP are affected by CVE-2026-10161?

The TRENDnet TEW-432BRP router contains a memory corruption vulnerability that could allow authenticated administrators or attackers with compromised credentials to execute code and compromise device…

Is there a public PoC exploit available for CVE-2026-10161?

Yes, a public proof-of-concept exploit is available for CVE-2026-10161. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10161?

Within 24 hours: Identify all TRENDnet TEW-432BRP routers on your network and restrict administrative access to trusted networks only; disable remote management capabilities. Within 7 days: Implement network segmentation to isolate affected routers from critical systems and sensitive data; establish monitoring for unauthorized access attempts. Within 30 days: Replace all affected routers with current-generation, actively supported equipment.

TRENDnet TEW-432BRP CVE-2026-10161

Q: What is the CVSS score of CVE-2026-10161?

CVE-2026-10161 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33480 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-34xq-f97c-943p

Buffer Overflow Stack Overflow Tew 432Brp

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 03:30 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 03:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 03:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 03:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 31, 2026 - 02:42 vuln.today

DescriptionCVE.org

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in TRENDnet TEW-432BRP router (firmware 3.10B20) allows authenticated remote attackers to corrupt memory via the status_statistic parameter in the /goform/formResetStatistic endpoint, potentially leading to code execution or device compromise. Publicly available exploit code exists on GitHub, and the vendor has confirmed the product is end-of-life (EOL since 2009) and will not be patched. No CISA KEV listing or EPSS data is provided in the input, so widespread exploitation status is unconfirmed.

Technical ContextAI

The affected device is a legacy TRENDnet TEW-432BRP SOHO wireless router whose web management interface uses the common embedded-Linux 'goform' CGI handler pattern. The vulnerable function formResetStatistic processes the status_statistic argument without adequate bounds checking, matching CWE-121 (Stack-Based Buffer Overflow), where attacker-supplied input overruns a fixed-size stack buffer and can overwrite the saved return address or adjacent stack control data. Such embedded MIPS/ARM router binaries typically lack modern exploit mitigations (often no ASLR, no stack canaries, NX inconsistently applied), making stack overflows in goform handlers a well-documented route to reliable code execution on this class of device. The CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:* indicates all firmware revisions of this model are presumed affected.

RemediationAI

No vendor-released patch identified at time of analysis - TRENDnet has formally declined to fix this issue because the TEW-432BRP has been EOL since 2009, so the only durable remediation is to decommission and replace the device with a currently supported router. As compensating controls until replacement, disable remote/WAN-side management of the web administration interface so /goform/formResetStatistic is not reachable from the internet (this prevents remote configuration but eliminates the WAN attack surface), restrict LAN access to the admin UI by ACL or VLAN segmentation to a dedicated management host (trade-off: loses ad-hoc management convenience), and change the default administrative credentials to a strong unique password since the CVSS PR:L requirement means valid auth is needed to invoke formResetStatistic. The public exploit details at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_14/14.md should be reviewed by defenders to build IDS/IPS signatures targeting oversized status_statistic POST bodies against /goform/formResetStatistic.