Which versions of TRENDnet TEW-432BRP are affected by CVE-2026-10181?

The TRENDnet TEW-432BRP wireless router (end-of-life since 2009) contains a stack-based buffer overflow affecting authenticated remote operations, with publicly available exploit code in circulation.

Is there a public PoC exploit available for CVE-2026-10181?

Yes, a public proof-of-concept exploit is available for CVE-2026-10181. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10181?

Within 24 hours: Scan network infrastructure for any TEW-432BRP devices on firmware version 3.10B20; immediately isolate discovered units from internet access. Within 7 days: Complete inventory of all legacy networking equipment; document business justification and network placement of any remaining devices. Within 30 days: Replace affected devices with modern, vendor-supported equipment, or implement network segmentation and access controls restricting device connectivity to authorized management traffic only.

TRENDnet TEW-432BRP CVE-2026-10181

Q: What is the CVSS score of CVE-2026-10181?

CVE-2026-10181 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33503 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-31 VulDB

GHSA-88p4-r3v2-m497

Buffer Overflow Stack Overflow Tew 432Brp

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 13:28 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 13:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 13:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 31, 2026 - 13:20 vuln.today

DescriptionCVE.org

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSysCmd of the file /goform/formSysCmd. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in TRENDnet TEW-432BRP wireless router firmware 3.10B20 allows remote authenticated attackers to corrupt memory via a crafted submit-url argument to the formSysCmd handler at /goform/formSysCmd. Publicly available exploit code exists per VulDB submission and a GitHub PoC, while the device has been end-of-life since 2009 and the vendor has explicitly stated they will not issue a fix. No CISA KEV listing or EPSS score was provided, but the combination of public PoC and abandoned product status makes any exposed device a concrete target.

Technical ContextAI

The TEW-432BRP is a legacy SOHO wireless router whose web management interface is implemented as a Boa/goform-style CGI binary. The vulnerable code path is the formSysCmd function, reached via the /goform/formSysCmd endpoint, which copies the submit-url request parameter into a fixed-size stack buffer without bounds checking - the classic CWE-121 stack-based buffer overflow pattern. On embedded MIPS/ARM SOHO devices of this era, such overflows typically overwrite the saved return address and, in the absence of ASLR, NX, or stack canaries, lead directly to arbitrary code execution in the context of the httpd process (commonly root). The CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:* covers all firmware versions, consistent with the vendor's refusal to investigate further.

RemediationAI

No vendor-released patch identified at time of analysis - TRENDnet has publicly declined to fix the issue because the TEW-432BRP has been EOL since 2009, so the primary remediation is hardware replacement with a currently supported router. Until decommissioned, immediately remove the device from any internet-facing role by disabling WAN-side HTTP/HTTPS administration and confirming remote management is off, restrict LAN-side access to /goform/formSysCmd via an upstream firewall or VLAN segmentation so only a dedicated admin host can reach the management interface, and change the web UI password from defaults to mitigate the PR:L precondition. Be aware these controls do not eliminate the bug - any authenticated LAN user or attacker who pivots onto the management network can still trigger the overflow - and disabling remote admin will prevent legitimate off-LAN configuration. Reference advisory: https://vuldb.com/vuln/367462; public PoC: https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_18/18.md.