TRENDnet TEW-432BRP CVE-2026-10162

Attacker must reach the device's HTTP management interface and possess valid web admin credentials (CVSS PR:L) to authenticate before invoking the formSetPassword handler at /goform/formSetPassword with an oversized webpage argument. Exploitation is limited by network reachability of the management UI - if WAN-side admin is disabled (the typical default), exploitation requires LAN-adjacent access or a chained CSRF/SSRF; if remote admin is enabled or the device is internet-exposed, any attacker with credentials can exploit it. No user interaction is required (UI:N), and the device must be the affected TEW-432BRP model running firmware 3.10B20 (and likely all versions per the wildcard CPE). The pool of vulnerable devices is bounded to remaining deployed units of a 2009-EOL consumer router.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L - i.e., authenticated, typically as the admin/default credentials common on SOHO routers) with high impact to confidentiality, integrity, and availability of the vulnerable component. Exploit maturity is marked Proof-of-Concept (E:P) and a public PoC exists on GitHub, raising practical risk. No EPSS score, SSVC decision, or CISA KEV entry was provided, so widespread automated exploitation cannot be confirmed; however, EOL SOHO routers are historically prime targets for botnet recruitment (Mirai-family). The PR:L requirement is a meaningful limiter - exploitation requires valid web UI credentials, but default/weak passwords on consumer routers frequently undermine this control. The decisive risk factor here is the vendor's explicit refusal to patch, which converts this from a time-bounded vulnerability into a permanent exposure for any device still deployed.

An attacker who has obtained or guessed the router's web admin credentials - often trivial on consumer devices left with default passwords - sends a crafted HTTP POST to /goform/formSetPassword with an oversized webpage parameter, overflowing a stack buffer in the formSetPassword handler and overwriting the saved return address. Given the absence of modern exploit mitigations on 2009-era embedded firmware and the publicly available PoC at github.com/wudipjq/my_vuln, this yields arbitrary code execution as the web server process (typically root on these devices), enabling persistent firmware-level compromise, DNS hijacking, or recruitment into a router botnet.