TRENDnet TEW-432BRP EUVD-2026-33461

Attacker requires network reachability to the TEW-432BRP web management interface (typically TCP/80 on the LAN, or WAN if remote management is enabled) and valid low-privilege authenticated access to the management UI (CVSS PR:L) - in practice this means knowledge of the admin password, which on many deployed units remains the factory default. The vulnerable code path is the formSetMACFilter handler at /goform/formSetMACFilter triggered by manipulating the filter_name argument, so the MAC filter configuration feature must be reachable in the affected web UI. Exploitation is limited to the specific TEW-432BRP model running firmware 3.10B20 (and per the wildcard CPE, plausibly all firmware revisions of this model); no user interaction is required (UI:N), but the requirement for valid admin credentials and the model's age/limited installed base constrain mass exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L) - meaning an authenticated session to the router's management interface is needed - with high confidentiality, integrity, and availability impact on the device itself (no scope change). The E:P (Proof-of-Concept) exploit maturity flag and the public GitHub PoC raise practical risk, but no CISA KEV listing, no EPSS score, and no SSVC decision data are provided in the input, so widespread automated exploitation cannot be confirmed. Realistic risk is bounded by three factors: (1) the device has been EOL for 15+ years so installed base is shrinking, (2) PR:L requires valid admin credentials (commonly default admin/admin on legacy TRENDnet gear, which materially elevates risk if WAN-side management or weak passwords are in use), and (3) no patch will ever be issued - making compensating controls the only mitigation path.

An attacker who has obtained or guessed administrator credentials to the router's web UI (often trivial on legacy SOHO devices with default passwords) sends a crafted HTTP POST to /goform/formSetMACFilter with an overlong filter_name value, overflowing the stack buffer to overwrite the saved return address and redirect execution to attacker-controlled shellcode or a ROP chain. A publicly available proof-of-concept is published on GitHub by researcher wudipjq, lowering the skill barrier; successful exploitation yields code execution on the router, enabling DNS hijacking, traffic interception, or pivoting into the LAN.