Which versions of TRENDnet TEW-635BRM are affected by CVE-2026-15480?

A stack-based buffer overflow vulnerability (CVE-2026-15480, CVSS 7.4) in the end-of-life TRENDnet TEW-635BRM wireless router allows authenticated remote attackers to execute arbitrary code on…

Is there a public PoC exploit available for CVE-2026-15480?

Yes, a public proof-of-concept exploit is available for CVE-2026-15480. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-15480?

Within 24 hours: Conduct asset inventory to identify all TRENDnet TEW-635BRM wireless routers in production and document firmware versions. Within 7 days: Implement network segmentation restricting administrative access to affected devices via firewall rules; enforce authentication from trusted networks only; isolate from critical system segments. Within 30 days: Complete replacement with vendor-supported wireless equipment; decommission and document removal of all TEW-635BRM units.

TRENDnet TEW-635BRM CVE-2026-15480

Q: What is the CVSS score of CVE-2026-15480?

CVE-2026-15480 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43202 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-12 VulDB

GHSA-r87c-jrw7-v29r

Buffer Overflow Stack Overflow Tew 635Brm Trendnet

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web service with low-complexity overflow, but the device_name handler requires an authenticated low-privilege session (PR:L); code execution on the device yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 06:23 vuln.today

CVSS changed

Jul 12, 2026 - 06:22 NVD

8.7 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument device_name leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in the TRENDnet TEW-635BRM wireless router (firmware up to 1.00.03) lets an authenticated remote attacker overflow a fixed-size stack buffer through the device_name argument handled by the start_httpd function in /sbin/rc, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists (VulDB), though it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis. The device has been end-of-life since 2011 and the vendor declined to confirm the flaw, meaning no fix will be issued.

Technical ContextAI

The TEW-635BRM is a consumer/SOHO wireless broadband router. The affected code path is the start_httpd routine inside the /sbin/rc init/service-control binary, which is part of the device's embedded web management service. The device_name parameter is copied into a fixed-size stack buffer without adequate bounds checking, the classic CWE-121 (Stack-based Buffer Overflow) pattern. On typical MIPS/ARM embedded Linux routers of this era, such overflows overwrite the saved return address on the stack and, absent modern mitigations (stack canaries, ASLR, NX are frequently missing on 2011-era firmware), can redirect execution to attacker-controlled shellcode or ROP chains running with the web service's privileges - commonly root on these appliances. The single CPE, cpe:2.3:a:trendnet:tew-635brm:*:*:*:*:*:*:*:*, confirms the scope is limited to this one product line.

RemediationAI

No vendor-released patch identified at time of analysis, and none is expected because the TEW-635BRM has been EOL since 2011 - TRENDnet's own guidance is to switch to a supported device, which is the recommended primary remediation (decommission and replace the router). As compensating controls for any units that must remain in service: disable remote/WAN-side administration so the web management service is unreachable from the internet, and restrict access to the LAN-side management interface to a trusted management VLAN or specific admin hosts via firewall/ACL - the trade-off is loss of convenient remote management. Change and strongly protect the web admin credentials since exploitation requires low-privilege authenticated access (PR:L); enforcing strong, unique credentials raises the bar to reach the vulnerable device_name handler. Where feasible, place the device behind an upstream firewall that blocks inbound access to its HTTP(S) management port. Consult the VulDB entry (https://vuldb.com/cve/CVE-2026-15480) for exploit details when validating these mitigations.