TRENDnet TEW-432BRP EUVD-2026-33478

Exploitation requires network reachability to the router's HTTP administration interface and authenticated access at admin/low-privilege level (CVSS PR:L) to invoke the /goform/formSysLog endpoint with a malicious current_page parameter; no user interaction is required (UI:N). Limiting factors are that the web admin interface is by default LAN-only on the TEW-432BRP - internet-facing exposure requires the owner to have enabled WAN-side remote management - and that valid credentials are needed, though the device's age means default credentials and unpatched remote-admin configurations are common in surviving deployments. Only the TRENDnet TEW-432BRP model (firmware 3.10B20 confirmed, all firmware revisions per CPE wildcard) is affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation with low privileges required and full confidentiality/integrity/availability impact on the device - meaning an attacker needs valid (often default) admin credentials to reach the vulnerable endpoint, which substantially limits mass exploitation but is trivially bypassed where default credentials remain unchanged. Publicly available exploit code exists (CVSS E:P, GitHub PoC by wudipjq), but the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread active exploitation cannot be confirmed. The genuine risk driver is the WONTFIX/EOL status: any TEW-432BRP still online is permanently vulnerable, making this a high-priority finding for asset inventories despite the modest CVSS score and authentication requirement.

An attacker with valid (or default) admin credentials to the router's web interface sends a crafted HTTP request to /goform/formSysLog with an oversized current_page parameter, overflowing the stack buffer in formSysLog and overwriting the saved return address to redirect execution to attacker-controlled shellcode or a ROP chain. Because a public PoC is hosted on GitHub, low-skill adversaries can reproduce the attack to gain code execution as the router's web daemon (typically root on these embedded devices), enabling DNS hijacking, persistent botnet implants, or pivoting into the LAN.