TRENDnet TEW-432BRP CVE-2026-109157

Exploitation requires network reachability to the TRENDnet TEW-432BRP (3.10B20) web management interface AND a valid low-privilege authenticated session (PR:L), which the attacker sends as a request to the /goform/formTcpipSetup handler with an overlong 'Name' parameter to overflow the stack buffer. Limiting factors: the device is EOL since 2011 with no patch, so remediation means replacement; the authentication requirement means exposure is sharply higher where the web UI is internet-facing or protected only by default/weak credentials, and negligible where management access is restricted to a trusted LAN. No special non-default feature toggle is required beyond normal use of the TCP/IP setup configuration page.

Signals are moderately consistent but point to a contained, not widespread, threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) rates this 8.6 with high confidentiality, integrity, and availability impact to both the vulnerable and subsequent systems, and the embedded E:P flag plus the 'POC publicly available' signal confirm publicly available exploit code exists - but there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active exploitation. Critically, PR:L indicates authentication to the router's web interface is required, which meaningfully reduces exposure versus an unauthenticated flaw. The single intelligence source is VulDB (reporter and all references), with no independent vendor advisory beyond TRENDnet's statement that the product was EOL'd in 2011 and cannot be tested; the vendor neither confirms nor denies the flaw exists, so affected-version certainty rests on a researcher PoC rather than vendor validation. Net: a genuinely high-impact bug on a device class that is attractive for botnet recruitment, but blunted by the authentication requirement, the product's end-of-life obscurity, and the absence of any exploitation-in-the-wild signal - treat as patch-if-present/replace-the-device rather than an emergency.

An attacker who can reach the router's web management interface and holds (or has obtained via weak/default credentials) a valid low-privilege session sends a crafted request to /goform/formTcpipSetup with an overlong 'Name' argument, overflowing a stack buffer in formTcpipSetup. A public proof-of-concept exists on GitHub (wudipjq/my_vuln), lowering the skill barrier; successful exploitation can crash the device or execute attacker-controlled code to take over the router. Because AC:L, the overflow is reliably triggerable once the attacker can authenticate.