TRENDnet TEW-432BRP EUVD-2026-33465

Exploitation requires (1) network reachability to the router's HTTP administration interface, typically the LAN-side web UI on port 80, and (2) valid low-privileged authentication to that interface as indicated by PR:L in the CVSS 4.0 vector. The specific vulnerable endpoint is /goform/formSetDomainFilter, which is part of the domain-filtering feature, so the attacker must be able to reach that CGI handler. Limiting factors: the device is a legacy 2009-era SOHO router with relatively low deployment density today, the admin interface is not exposed to the WAN by default, and authentication is required - though default credentials on unmaintained legacy hardware substantially weaken this barrier. The vulnerability affects all firmware revisions of TEW-432BRP per the wildcard CPE and vendor EOL statement.

CVSS 4.0 7.4 reflects network attack vector, low complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability of the device itself (E:P confirms a proof-of-concept exploit is reported). The PR:L requirement means an attacker must hold valid admin or low-privileged credentials on the web UI, which sharply reduces exposure on devices that are not internet-facing and still have non-default credentials; however, SOHO routers of this vintage are notoriously deployed with default or weak passwords, so PR:L is a thin barrier in practice. No EPSS score or CISA KEV listing was provided in the input, so widespread mass exploitation cannot be asserted, but the combination of public PoC code on GitHub, a permanently unpatched device, and a trivially reachable HTTP endpoint makes this a credible opportunistic target. The bounded scope (SC:N/SI:N/SA:N) indicates the blast radius is the router itself, though router compromise enables downstream traffic interception and pivoting.

An attacker who has obtained or guessed low-privileged web-UI credentials (often trivial on legacy SOHO routers with default passwords) sends a crafted HTTP POST to /goform/formSetDomainFilter containing an oversized blocked_domain or permitted_domain_list value, overflowing the stack buffer in formSetDomainFilter and likely achieving arbitrary code execution on the router given the absence of modern exploit mitigations on embedded devices of this era. Public exploit code is available on GitHub, lowering the skill barrier for opportunistic attackers scanning for exposed TEW-432BRP units to hijack for traffic interception, DNS redirection, or botnet recruitment.