Tew 657Brm EUVD-2026-18358

Authenticated access required to Trendnet TEW-657BRM 1.00.1 router's /setup.cgi interface. Attacker must send crafted request with oversized mac_pc_dba parameter to add_apcdb function. Product discontinued since June 2011; no vendor support available.

Real-world risk assessment presents a nuanced picture. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with an exploit maturity indicator of POC available (E:P). The publicly available exploit code on GitHub substantially increases exploitation risk for the limited installed base. However, multiple mitigating factors reduce overall urgency: (1) the product reached end-of-life over 14 years ago in 2011, meaning the deployed footprint is extremely small compared to current products; (2) authentication is required (PR:L), limiting attack surface to scenarios where credentials are compromised or default/weak passwords remain in use; (3) no EPSS score or CISA KEV inclusion suggests no observed mass exploitation campaigns; (4) the vendor's discontinuation statement and public disclosure mean remaining users have been warned. From an SSVC perspective, while technical impact is total system compromise and exploitation is proven possible with public POC, automatable mass exploitation is constrained by the authentication requirement and small target population. Organizations should prioritize this only if TEW-657BRM devices are confirmed in their inventory; otherwise, this represents a low-priority issue affecting obsolete equipment that should have been replaced years ago per standard hardware lifecycle policies.

An attacker who has obtained valid administrative credentials to a Trendnet TEW-657BRM router (through credential stuffing, default password usage, or phishing) connects remotely to the web management interface and crafts a malicious HTTP request to /setup.cgi. The attacker includes an oversized payload in the mac_pc_dba parameter designed to overflow the stack buffer in the add_apcdb function, overwriting the return address to redirect execution to attacker-controlled shellcode. Upon successful exploitation, the attacker gains root-level code execution on the router, enabling installation of persistent backdoors, traffic interception, DNS hijacking to redirect users to malicious sites, or use of the compromised router as a pivot point for lateral movement into the internal network. The publicly available exploit code on GitHub provides a ready-made attack tool, eliminating the need for advanced exploit development skills.