Which versions of TRENDnet TEW-432BRP are affected by EUVD-2026-33326?

TRENDnet TEW-432BRP wireless routers (firmware 3.10B20) contain an unpatched stack-based buffer overflow permitting authenticated remote code execution; the vendor declined to patch this end-of-life…

Is there a public PoC exploit available for EUVD-2026-33326?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33326. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33326?

Within 24 hours: Inventory all deployed TEW-432BRP units and immediately restrict administrative access to trusted personnel. Within 7 days: Initiate replacement with current-generation, actively supported router models; document business justification for any retained devices. Within 30 days: Complete retirement of all TEW-432BRP units and validate removal from network.

TRENDnet TEW-432BRP EUVD-2026-33326

Q: What is the CVSS score of EUVD-2026-33326?

EUVD-2026-33326 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10063 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-29 VulDB

GHSA-8wp9-qgxj-6pm5

Buffer Overflow Stack Overflow Tew 432Brp

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 29, 2026 - 15:29 vuln.today

v3 (cvss_changed)

Analysis Updated

May 29, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 29, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

May 29, 2026 - 15:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 29, 2026 - 15:16 vuln.today

DescriptionCVE.org

A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formWPS of the file /goform/formWPS. Such manipulation of the argument peerPin leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in TRENDnet TEW-432BRP wireless router firmware 3.10B20 allows authenticated remote attackers to corrupt memory via the peerPin parameter handled by the formWPS function in /goform/formWPS, potentially leading to arbitrary code execution or device crash. Publicly available exploit code exists, and the vendor has explicitly declined to issue a fix as the device has been end-of-life since 2009. No CISA KEV listing or EPSS score is provided, but the combination of public POC and unpatchable status materially elevates real-world risk for any device still deployed.

Technical ContextAI

The TEW-432BRP is a legacy SOHO wireless router whose web management interface exposes a CGI-style handler at /goform/formWPS implementing Wi-Fi Protected Setup (WPS) configuration. CWE-121 (Stack-based Buffer Overflow) indicates the formWPS function copies the attacker-controlled peerPin argument into a fixed-size stack buffer without adequate bounds checking, overwriting the saved return address or adjacent stack data. Embedded MIPS/ARM routers of this era typically ship without ASLR, stack canaries, or non-executable stack protections, which makes stack overflows reliably exploitable for shellcode injection or ROP. The single CPE entry (cpe:2.3:a:trendnet:tew-432brp:*:*) scopes the issue to this specific TRENDnet model, and the firmware version 3.10B20 named in the description corresponds to the final EOL release line.

RemediationAI

No vendor-released patch identified at time of analysis - TRENDnet has publicly stated they will not fix this issue because the TEW-432BRP has been EOL since 2009, so the only durable remediation is to decommission the device and replace it with a currently supported router. Until replacement, restrict access to the web management interface by disabling remote/WAN administration entirely in the router settings (the trade-off is losing remote configurability), placing the LAN-side management IP behind an ACL that only permits a single trusted host, and ensuring WPS is disabled to reduce exposure of the vulnerable /goform/formWPS handler (note: disabling WPS may still leave the handler reachable for authenticated sessions, so credential rotation to a long random password is essential). Reference details: https://vuldb.com/vuln/367149 and the exploit publication at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_4/4.md.