EUVD-2026-33503
GHSA-88p4-r3v2-m497
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed TEW-432BRP web UI
-
DeliveryObtain or default-guess admin credential
-
ExploitPOST oversized submit-url to /goform/formSysCmd
-
InstallOverflow stack buffer in formSysCmd
-
C2Hijack saved return address
-
ExecuteExecute shellcode as httpd/root
-
ImpactPivot into LAN or persist on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be able to reach the device's HTTP management interface (LAN-side by default, or WAN-side if the owner enabled remote administration) and must possess valid web UI credentials, since CVSS PR:L indicates low-privileged authentication is required - on these consumer routers that is frequently the unchanged factory default admin password. The specific trigger is an HTTP request to /goform/formSysCmd with an oversized submit-url parameter handled by formSysCmd in firmware 3.10B20 of the TEW-432BRP. Exploitation is limited to this specific TRENDnet model and is constrained by the device's small remaining install base and the requirement to first authenticate; no user interaction (UI:N) and no additional configuration toggles are needed beyond the management interface being reachable. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 and indicates a network-reachable, low-complexity attack that nonetheless requires low-level privileges (PR:L) - meaning a valid web UI credential, which on these consumer routers is often the unchanged default. E:P confirms a proof-of-concept exists, matching the published GitHub PoC. No EPSS score, KEV listing, or SSVC decision were supplied in the input, so widespread mass-exploitation cannot be confirmed; however, the device is EOL since 2009 with no patch forthcoming, so any internet-exposed unit is a durable opportunistic target. Real-world priority is high for anyone still operating this hardware and modest at a fleet level given the small remaining install base. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed a low-privileged web UI credential (or reaches an internet-exposed admin interface where defaults remain) sends a single HTTP POST to /goform/formSysCmd with an overlong submit-url parameter, overflowing the stack buffer in formSysCmd and overwriting the saved return address to redirect execution. Because the public GitHub PoC at wudipjq/my_vuln/TRENDnet/vuln_18 already demonstrates the crash primitive, weaponization to a root shell on the router is a straightforward next step for an attacker willing to fingerprint the exact firmware build. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in TRENDnet TEW-432BRP wireless router firmware 3.10B20 allows remote authenticated attackers to corrupt memory via a crafted submit-url argument to the formSysCmd handler at /goform/formSysCmd. Publicly available exploit code exists per VulDB submission and a GitHub PoC, while the device has been end-of-life since 2009 and the vendor has explicitly stated they will not issue a fix. No CISA KEV listing or EPSS score was provided, but the combination of public PoC and abandoned product status makes any exposed device a concrete target.
Earlier versions of this analysis (2)
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router's formSysCmd function (/goform/formSysCmd) allows remote attackers to corrupt memory via a crafted submit-url argument. Publicly available exploit code exists, and the vendor has explicitly refused to issue a fix as the device has been end-of-life since 2009. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privileges required, making any still-deployed units a persistent risk.
Stack-based buffer overflow in the TRENDnet TEW-432BRP 3.10B20 wireless router allows remote attackers with low-privilege access to execute arbitrary code by manipulating the submit-url argument in the formSysCmd handler at /goform/formSysCmd. Publicly available exploit code exists for this flaw, and the vendor has confirmed the device will not be patched because it reached end-of-life in 2009. No active exploitation has been documented in CISA KEV, but the combination of a working POC and an unpatched EOL device makes any exposed instance a standing risk.
RemediationAI
No vendor-released patch identified at time of analysis - TRENDnet has publicly declined to fix the issue because the TEW-432BRP has been EOL since 2009, so the primary remediation is hardware replacement with a currently supported router. Until decommissioned, immediately remove the device from any internet-facing role by disabling WAN-side HTTP/HTTPS administration and confirming remote management is off, restrict LAN-side access to /goform/formSysCmd via an upstream firewall or VLAN segmentation so only a dedicated admin host can reach the management interface, and change the web UI password from defaults to mitigate the PR:L precondition. Be aware these controls do not eliminate the bug - any authenticated LAN user or attacker who pivots onto the management network can still trigger the overflow - and disabling remote admin will prevent legitimate off-LAN configuration. Reference advisory: https://vuldb.com/vuln/367462; public PoC: https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_18/18.md.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TEW-432BRP is a legacy SOHO wireless router whose web management interface is implemented as a Boa/goform-style CGI binary. The vulnerable code path is the formSysCmd function, reached via the /goform/formSysCmd endpoint, which copies the submit-url request parameter into a fixed-size stack buffer without bounds checking - the classic CWE-121 stack-based buffer overflow pattern. On embedded MIPS/ARM SOHO devices of this era, such overflows typically overwrite the saved return address and, in the absence of ASLR, NX, or stack canaries, lead directly to arbitrary code execution in the context of the httpd process (commonly root). The CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:* covers all firmware versions, consistent with the vendor's refusal to investigate further.
Know when Tew 432Brp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSysCmd of the file /goform/formSysCmd. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
The TRENDnet TEW-432BRP wireless router (end-of-life since 2009) contains a stack-based buffer overflow affecting authenticated remote operations, with publicly available exploit code in circulation. The vendor has explicitly refused to issue patches, creating permanent unfixable risk for any organization still operating this legacy hardware. This affects primarily older network infrastructure with no vendor recourse.
No vendor-released patch identified at time of analysis. Implement network segmentation to isolate devices from general network and internet; restrict administrative access via firewall rules and authentication controls; disable any unused network services on affected devices; deploy network monitoring to detect exploitation attempts; prioritize device replacement as primary remediation strategy.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Tew 432Brp
View allStack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router allows remote attackers with low privileges to corrupt
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows authenticated remote attackers to corr
Stack-based buffer overflow in TRENDnet TEW-432BRP router (firmware 3.10B20) allows authenticated remote attackers to co
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 wireless router allows authenticated remote attackers to corr
Stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router (firmware 3.10B20) allows authenticated remote at
Stack-based buffer overflow in the TRENDnet TEW-432BRP 3.10B20 wireless router's web interface allows authenticated remo
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows authenticated remote attackers to corr
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 routers allows authenticated remote attackers to corrupt memo
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows remote authenticated attackers to corr
Stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router (firmware 3.10B20) allows remote authenticated at
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows authenticated remote attackers to corr
Exploit-DB