Tew 657Brm CVE-2026-5350

Requires authenticated access to Trendnet TEW-657BRM firmware version 1.00.1. Attacker must have login credentials to access /setup.cgi and manipulate the mac_pc_dba parameter in the update_pcdb function. Product discontinued since June 2011; modern devices unaffected.

Real-world risk assessment presents a nuanced picture combining multiple signals. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N), low complexity (AC:L), and requires low privileges (PR:L). The Environmental Score modifier E:P confirms proof-of-concept exploit existence, corroborated by the GitHub repository containing weaponizable exploit code. However, several factors moderate practical risk: the product has been end-of-life since 2011, dramatically limiting the installed base; authentication requirement (PR:L) raises the exploitation bar compared to unauthenticated vulnerabilities; no CISA KEV listing indicates no confirmed active exploitation campaigns; EPSS data not provided but likely low given the narrow target demographic. The SSVC framework assessment would rate this as Low priority for most organizations due to obsolete product status, though any entity still operating these legacy devices faces Critical risk given the combination of remote exploitability, public POC, vendor abandonment, and complete system compromise potential. The authentication requirement prevents mass-exploitation but does not prevent targeted attacks where default credentials or credential reuse is common in legacy infrastructure.

An attacker identifies a Trendnet TEW-657BRM router exposed on a corporate network, either through internet scanning or after compromising an internal system. Using default or brute-forced credentials (common in legacy devices), the attacker authenticates to the web management interface and sends a specially crafted HTTP request to /setup.cgi with an oversized mac_pc_dba parameter following the publicly available exploit code from GitHub. The stack buffer overflow corrupts memory, hijacking execution flow to attacker-supplied shellcode that establishes persistent backdoor access to the router. From this position, the attacker can intercept all network traffic passing through the device, modify DNS responses to redirect users to phishing sites, pivot to other internal network segments, or use the compromised router as a command-and-control foothold. The low attack complexity and public POC availability make this scenario readily achievable for attackers with basic exploitation skills.