Which versions of Tew 632brp are affected by CVE-2026-4172?

A publicly exploitable remote code execution vulnerability affects TRENDnet TEW-632BRP routers with no available patch from the vendor.

Is there a public PoC exploit available for CVE-2026-4172?

Yes, a public proof-of-concept exploit is available for CVE-2026-4172. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4172?

Within 24 hours: Inventory all TRENDnet TEW-632BRP devices in your environment and isolate affected units from production networks if possible. Within 7 days: Implement network segmentation to restrict access to the HTTP POST endpoint on port 80/443, disable remote management features, and monitor for exploitation attempts. Within 30 days: Evaluate replacement options with supported vendor alternatives and develop a migration plan to phase out all vulnerable TEW-632BRP devices.

Tew 632brp CVE-2026-4172

Q: What is the CVSS score of CVE-2026-4172?

CVE-2026-4172 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12218 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-15 VulDB

Buffer Overflow Stack Overflow Tew 632brp Trendnet

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.2 (HIGH) 7.3 (HIGH)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 09:00 euvd

EUVD-2026-12218

Analysis Generated

Mar 15, 2026 - 09:00 vuln.today

CVE Published

Mar 15, 2026 - 08:32 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was detected in TRENDnet TEW-632BRP 1.010B32. This affects an unknown part of the file /ping_response.cgi of the component HTTP POST Request Handler. The manipulation of the argument ping_ipaddr results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow vulnerability in TRENDnet TEW-632BRP firmware version 1.010B32, specifically in the ping_response.cgi file's HTTP POST request handler. An authenticated attacker with high privileges can exploit this vulnerability remotely to achieve code execution with high impact to confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub, though the vulnerability is not listed in CISA KEV and no EPSS score is provided.

Technical ContextAI

The vulnerability affects TRENDnet's TEW-632BRP wireless router (CPE: cpe:2.3:a:trendnet:tew-632brp:*:*:*:*:*:*:*:*) running firmware version 1.010B32. The root cause is CWE-121 (Stack-based Buffer Overflow), where the ping_ipaddr parameter in /ping_response.cgi is not properly validated before being copied to a fixed-size stack buffer. This is a classic memory corruption issue in embedded device web interfaces, where user-supplied input to diagnostic utilities (ping functionality) is not sanitized, allowing an attacker to overwrite the stack and potentially execute arbitrary code.

RemediationAI

No official patch or firmware update is available as the vendor did not respond to the vulnerability disclosure. Recommended mitigations include: 1) Replace affected TEW-632BRP devices with newer, supported models; 2) Restrict administrative access to trusted IP addresses only; 3) Use strong, unique administrative credentials; 4) Disable remote administration if not required; 5) Place the device behind a properly configured firewall to limit exposure. Monitor VulDB (ID: 351079) for any future vendor response or patch availability.