TRENDnet TEW-432BRP EUVD-2026-33464

Exploitation requires network reachability to the router's HTTP management interface and low-privilege authenticated access to the web UI (CVSS PR:L), specifically the ability to POST to the /goform/formSetProtocolFilter endpoint with an attacker-controlled protocol_name parameter. The attack is limited by the management interface typically being bound to the LAN by default on TEW-432BRP devices, so remote internet exploitation generally requires WAN-side remote administration to be enabled or the attacker to already have a position on the same network. No user interaction is required (UI:N), the attack complexity is low (AC:L), and the target must be the specific TRENDnet TEW-432BRP model running vulnerable firmware (3.10B20 confirmed).

Signals are mixed but lean toward real-world risk for any organization still operating this device. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 (High) - network reachable, low complexity, low privileges required, no user interaction, with high confidentiality, integrity, and availability impact and an E:P (Proof-of-Concept) maturity flag. Publicly available exploit code exists on GitHub (wudipjq/my_vuln), which materially raises practical risk. The CVE is not currently listed in CISA KEV and no EPSS score was provided in the input, so widespread active exploitation cannot be confirmed. The decisive factor is that the vendor has explicitly refused to patch (EOL since 2009), meaning any exposed device is permanently vulnerable; however, the management interface on consumer routers is typically LAN-bound by default, so internet-exposed exploitation likely requires either WAN management to be enabled or a foothold on the local network.

An attacker with low-privilege credentials to the router's web UI - obtained via default passwords, credential reuse, phishing, or an internal foothold - sends an HTTP POST to /goform/formSetProtocolFilter containing an overlong protocol_name value. The oversized value overflows the stack buffer in formSetProtocolFilter, overwriting the saved return address and redirecting execution to attacker-controlled shellcode, yielding code execution as the web server process (typically root on embedded routers). Public PoC code exists on GitHub, lowering the skill barrier to weaponize this attack.