TRENDnet TEW-432BRP EUVD-2026-33477

The attacker must be able to reach the router's HTTP administration interface (typically TCP/80 on the LAN, and on the WAN only if remote management is enabled) and must possess valid administrative credentials, as indicated by PR:L in the CVSS 4.0 vector; the vulnerable code path is the formPortFw handler at /goform/formPortFw, so the device's port-forwarding configuration page must be reachable and the server_name parameter accepted by that handler. Exploitation is limited to the TRENDnet TEW-432BRP model on firmware 3.10B20 (an EOL device released before 2009), so realistic exposure is bounded by how many of these legacy routers remain deployed and internet-reachable; no user interaction is required (UI:N), and attack complexity is low (AC:L) once credentials and network access are obtained.

CVSS 4.0 scores this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H - network reachable, low complexity, but requiring low privileges (PR:L), indicating an authenticated session is needed. Publicly available exploit code exists (referenced GitHub PoC by wudipjq), which materially raises real-world risk despite the auth requirement, since default or weak admin credentials on legacy SOHO routers are extremely common. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so widespread automated exploitation cannot be confirmed; however, the combination of a public PoC, vendor refusal to patch, and the typical exposure of router admin interfaces on LAN (and occasionally WAN via remote management) makes any internet-exposed device a realistic compromise target. Note the conflict between PR:L in the vector and the description's omission of any authentication discussion - this should be verified against the PoC, as some /goform endpoints on similar TRENDnet firmware are known to be reachable pre-auth.

An attacker who has obtained admin credentials to a TEW-432BRP - for example via default credentials, credential reuse, phishing the owner, or pivoting from a compromised LAN host - submits a POST request to /goform/formPortFw with an overlong server_name value, overflowing the stack buffer in formPortFw and overwriting the saved return address to redirect execution to embedded shellcode or a ROP chain. With a working public PoC already published on GitHub, weaponization is trivial, yielding code execution in the context of the router's web daemon and enabling DNS hijacking, traffic interception, or use of the device as a foothold inside the victim network.