Which versions of TRENDnet TEW-432BRP are affected by EUVD-2026-33322?

The TRENDnet TEW-432BRP router, end-of-life since 2009, contains a remotely exploitable memory corruption vulnerability that authenticated attackers can abuse to execute arbitrary code; organizations…

Is there a public PoC exploit available for EUVD-2026-33322?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33322. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33322?

Within 24 hours: conduct network inventory scan to identify any TRENDnet TEW-432BRP units in production and document owner/location of each device. Within 7 days: develop device replacement roadmap specifying current-generation router models, set procurement timeline, and implement network access controls restricting who can reach device management interfaces. Within 30 days: retire and remove all identified TRENDnet TEW-432BRP routers from production; if replacement is not immediately feasible, isolate devices on segregated network segments and disable all remote management access.

TRENDnet TEW-432BRP EUVD-2026-33322

Q: What is the CVSS score of EUVD-2026-33322?

EUVD-2026-33322 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10062 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-29 VulDB

GHSA-f6m3-35xp-mwj6

Buffer Overflow Stack Overflow Tew 432Brp

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 29, 2026 - 15:30 vuln.today

v3 (cvss_changed)

Analysis Updated

May 29, 2026 - 15:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 29, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

May 29, 2026 - 15:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 29, 2026 - 15:15 vuln.today

DescriptionCVE.org

A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in TRENDnet TEW-432BRP router firmware 3.10B20 allows authenticated remote attackers to corrupt memory by sending crafted ip, mask, or gateway parameters to the formSetRoute handler at /goform/formSetRoute, potentially achieving arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), and because the product has been end-of-life since 2009 the vendor has explicitly declined to issue a fix. No active exploitation has been confirmed via CISA KEV at time of analysis.

Technical ContextAI

The flaw resides in the formSetRoute function exposed through the router's web administration goform interface (/goform/formSetRoute), a common CGI-style endpoint pattern in legacy SOHO routers. CWE-121 (Stack-based Buffer Overflow) indicates that user-supplied values for the ip, mask, and gateway HTTP parameters are copied into fixed-size stack buffers without proper length validation, allowing an attacker to overwrite the saved return address or adjacent stack frame data. The affected CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:* identifies the TRENDnet TEW-432BRP 802.11g wireless router, a consumer device whose firmware (typically MIPS-based with limited mitigations such as no ASLR or stack canaries) makes such overflows historically reliable for code execution.

RemediationAI

No vendor-released patch identified at time of analysis, and none will be issued because the device has been EOL since 2009. The only durable remediation is to decommission and replace the TEW-432BRP with a currently-supported router that receives security updates. Until replacement, compensating controls include disabling remote/WAN administration so /goform/formSetRoute is not reachable from the Internet (trade-off: loss of remote management convenience), restricting LAN access to the admin interface via firewall rules or VLAN segmentation so only a trusted management host can reach the web UI (trade-off: additional network configuration overhead), enforcing strong unique admin credentials and changing the default password to raise the PR:L barrier against opportunistic abuse, and monitoring HTTP POST requests to /goform/formSetRoute for anomalous ip/mask/gateway field lengths. Public exploit details and the technical write-up are available at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_3/3.md and https://vuldb.com/vuln/367148.