EUVD-2026-125948
GHSA-r63q-p323-qrrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device mini_httpd interface
-
DeliverySend crafted request to /setup.cgi
-
ExploitOverflow buffer via sprintf
-
ExecutionOut-of-bounds write corrupts memory
-
ImpactGain code execution on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the /setup.cgi endpoint served by the mini_httpd web server on TRENDnet TEW-657BRM 1.00.1, where attacker-supplied input reaches a sprintf call causing an out-of-bounds write. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required; authentication requirements are not independently confirmed from the description, which does not state whether /setup.cgi is reachable pre-auth. The principal limiting factor is reachability: the attacker must have network access to the device's HTTP management interface, which is typically LAN-side unless remote/WAN management is enabled, plus the device must still be deployed despite 15+ years of EOL status. No patch is available, as the product is unsupported. |
| Impact | Signals are mixed-to-high. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw with full impact, and the vuln.today Decision label is 'act_now', which argues for prioritization. Countervailing signals materially lower real-world urgency: no EPSS score was supplied, the CVE is NOT listed in CISA KEV (no confirmed active exploitation), and the only exploit artifact is a GitHub advisory reference that is explicitly not verified as working exploit code. The vendor (TRENDnet) states it cannot confirm the vulnerability because the TEW-657BRM has been EOL for more than 15 years and will only issue a customer notice - so there will be no patch. Net: this is a credible unauthenticated remote OOB-write (CWE-787) in a web management CGI, but its practical risk is bounded by the product's age and tiny deployment footprint rather than by evidence of mass exploitation. The 'act_now' label conflicts with the absence of KEV/EPSS corroboration; treat it as 'patch unavailable, so compensating controls now' rather than evidence of widespread active attack. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's mini_httpd web interface sends a crafted request to /setup.cgi whose input is passed to sprintf, overflowing a fixed buffer and causing an out-of-bounds write that can corrupt memory and potentially execute code on the device. Per the CVSS vector this requires no authentication and no user interaction. A public PoC reference exists but is not verified as working exploit code, so weaponization effort is unproven. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 14, 2026
An out-of-bounds write in the mini_httpd web server component of TRENDnet TEW-657BRM firmware 1.00.1 lets remote attackers corrupt memory through unfiltered input passed to a sprintf call in /setup.cgi, with a CVSS 4.0 base score of 9.3 indicating high confidentiality, integrity and availability impact. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, although the sources do not confirm whether /setup.cgi is reachable before login; the practical gating factor is network reachability of the device's HTTP management interface, which is usually LAN-side unless remote management is enabled. A public PoC reference exists (a GitHub router-firmware advisory); it is not verified as working exploit code, and the issue is not listed in CISA KEV, but the vuln.today decision label is act_now. TRENDnet states the product has been end-of-life for more than 15 years and that it cannot confirm the flaw, so no fix is expected.
Earlier versions of this analysis (1)
An out-of-bounds write in the mini_httpd web management component of TRENDnet TEW-657BRM firmware 1.00.1 lets remote attackers reach the sprintf call in /setup.cgi with attacker-supplied data, corrupting memory in a way scored at maximum severity (CVSS 4.0 base 10.0, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact). Per the assessed vector no authentication or user interaction is required, but exploitation depends on the device's web interface being network-reachable, which is typically LAN-only unless remote administration was enabled. A public PoC reference tied to a GitHub router-firmware advisory exists; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Realistic exposure is constrained by the vendor's statement that the product has been end-of-life for more than 15 years and will not be patched.
RemediationAI
No vendor-released patch identified at time of analysis: TRENDnet states the TEW-657BRM has been EOL for more than 15 years and that it cannot confirm the vulnerability, so the only complete fix is to retire and replace the device with a supported router. Until replacement, reduce exposure with targeted controls on the HTTP management plane. Disable WAN/remote management and any port-forwarding, UPnP or DMZ rules that publish TCP/80 to the internet - the trade-off is that you lose off-site administration. Restrict the management interface to a dedicated admin VLAN or an allow-list of source addresses via an upstream firewall, accepting that any host on that segment can still reach the vulnerable CGI. If the router's UI is not needed, block inbound TCP/80 at the perimeter; blocking it disables web administration but leaves the device forwarding traffic. Isolate the router and its segment from user and business networks, and monitor for the device's HTTP service being reachable from untrusted zones. These are containment measures only - none removes the sprintf overflow in /setup.cgi. Because the vuln.today decision label is act_now and a public PoC reference exists (not verified as working exploit code, and not in CISA KEV), treat reachable instances as exposed and prioritize replacement over mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is mini_httpd, a small embeddable HTTP server widely reused in consumer routers, which here fronts the device's CGI-based administrative interface at /setup.cgi. The flaw is an out-of-bounds write (CWE-787): attacker-controlled input reaches a sprintf() call in the CGI handler without bounds checking on the destination buffer, so an oversized value can overflow adjacent memory. Because sprintf writes a formatted string plus a terminating NUL with no length limit, the corruption is a straightforward memory-safety bug rather than a logic error; the available sources do not describe the precise request parameter, buffer layout, or whether the overflow lands on the stack or heap, so the exact trigger beyond the /setup.cgi handler is not described in the available sources. The CPE cpe:2.3:a:trendnet:tew-657brm:*:*:*:*:*:*:*:* is version-agnostic, while EUVD pins the confirmed affected build to 1.00.1. Note that the supplier-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with E:P) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree on unauthenticated, no-interaction network exploitation, but neither source documents whether the CGI endpoint can be hit pre-authentication in a default configuration.
Know when Tew 657Brm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable CGI, low complexity, no auth/UI per reported vector; OOB write on an embedded device yields full code-execution impact, so C/I/A:H with unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know." This vulnerability only affects products that are no longer supported by the maintainer.
Technical POC Analysis
The flaw is an out-of-bounds write, CWE-787, also described as CWE-120 classic buffer overflow, in /usr/sbin/minihttpd on firmware 1.00.1.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical memory-corruption flaw affects TRENDnet TEW-657BRM routers running firmware 1.00.1, a product the vendor has declared end-of-life for over 15 years and will not fix. Because the device is unsupported, any exposure of its management interface is a persistent, unpatchable risk to the networks where these units still operate, so leadership should focus on locating and retiring or isolating them.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN management on the HTTP interface, restrict management access to trusted LAN segments via firewall or VLAN segmentation, and plan replacement of end-of-life devices.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Tew 657Brm
View allStack-based buffer overflow in Trendnet TEW-657BRM 1.00.1 wireless router allows authenticated remote attackers to achie
Stack-based buffer overflow in Trendnet TEW-657BRM router firmware 1.00.1 allows authenticated remote attackers to achie
Remote authenticated command injection in TrendNet TEW-657BRM 1.00.1 allows manipulation of the policy_name parameter in
OS command injection in Trendnet TEW-657BRM 1.00.1 ping_test function allows authenticated remote attackers to execute a
Remote code execution via OS command injection in TrendNet TEW-657BRM 1.00.1 allows authenticated attackers to execute a
OS command injection in TrendNet TEW-657BRM 1.00.1 router allows authenticated remote attackers to execute arbitrary com
Exploit-DB