TRENDnet TEW-432BRP EUVD-2026-33322

Exploitation requires authenticated access (CVSS PR:L) to the TRENDnet TEW-432BRP web administration interface and network reachability to the /goform/formSetRoute endpoint, specifically the ability to submit the formSetRoute form with attacker-controlled ip, mask, and gateway parameters. Limiting factors include: the admin web UI must be reachable from the attacker's network position (LAN by default, or WAN only if remote management is enabled), valid administrator credentials are required (often weakened in practice by default/unchanged passwords on legacy SOHO devices), and the target must be the specific TEW-432BRP hardware running firmware 3.10B20. No user interaction is required (UI:N), and no special non-default configuration is needed beyond a logged-in administrative session.

CVSS 4.0 scores this 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, signaling network-reachable, low-complexity exploitation that requires low privileges (an authenticated session on the router's web UI) and yields high confidentiality, integrity, and availability impact on the device itself with no scope change. Exploit maturity E:P (Proof-of-Concept) aligns with the public GitHub PoC, and the vulnerability is reported by VulDB rather than the vendor. It is not present in CISA KEV and no EPSS score was supplied, so widespread automated exploitation is not currently evidenced; however, default or weak admin credentials on legacy SOHO devices frequently degrade the PR:L barrier in practice. Real-world priority depends heavily on whether any TEW-432BRP units remain Internet-exposed - the EOL status (since 2009) means no patch will ever ship, so any remaining deployments are permanently vulnerable. Note that the description states the attack is possible remotely while CVSS requires PR:L; this is consistent (authenticated remote attack) but defenders should verify whether the admin interface is exposed to WAN.

An attacker who has obtained admin credentials to the router's web interface - through default-credential reuse, phishing, or LAN-side access - sends a crafted HTTP POST to /goform/formSetRoute with an oversized ip, mask, or gateway value, overflowing a stack buffer in formSetRoute and overwriting the return address to redirect execution. Because legacy SOHO firmware typically lacks ASLR and non-executable stacks, the attacker can stage shellcode for the router's MIPS architecture and gain persistent control of the gateway, pivoting to intercept or redirect all LAN traffic. A public PoC at the referenced GitHub repository demonstrates the parameter manipulation, lowering the skill barrier.