EUVD-2026-33480
GHSA-34xq-f97c-943p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDiscover exposed TEW-432BRP admin UI
-
DeliveryAuthenticate with default or known credentials
-
ExploitPOST oversized status_statistic to /goform/formResetStatistic
-
InstallOverflow stack buffer in formResetStatistic
-
C2Overwrite saved return address with ROP chain
-
ExecuteExecute shellcode as web server
-
ImpactPivot into LAN or persist on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the router's HTTP administration interface - by default LAN-only, but exposed to the internet on units where the owner enabled WAN-side remote management; (2) valid low-privilege credentials to the admin UI per CVSS PR:L, which on TEW-432BRP units is most commonly the factory default admin/admin or any operator-set password; and (3) the ability to send a POST to the specific endpoint /goform/formResetStatistic with an oversized status_statistic parameter to trigger the stack overflow in formResetStatistic. No user interaction is needed (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors: the device must actually be a TRENDnet TEW-432BRP running firmware 3.10B20 (a 2009-era consumer router with shrinking install base), and reliable code execution beyond a crash requires the attacker to craft architecture-specific shellcode for this firmware build. |
| Impact | The CVSS:4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 (High), reflecting network-reachable, low-complexity exploitation that requires low-privilege authentication but yields high impact to confidentiality, integrity, and availability on the device itself (scope-changed metrics are 'None', so impact is contained to the router). Exploit maturity is flagged Proof-of-Concept (E:P) and a working PoC is published on GitHub, meaningfully raising practical risk. No EPSS score and no CISA KEV listing were supplied, so there is no evidence of mass exploitation, but the combination of public PoC + trivial web-form attack surface + permanent unpatched status makes any exposed device a soft target. A key caveat: PR:L implies the attacker needs valid credentials to the admin web UI, yet many TEW-432BRP units historically shipped with default admin/admin credentials and are reachable from the WAN if remote management was enabled - this gap between formal CVSS prerequisites and real-world deployment hygiene likely understates true risk. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed administrative web credentials (including via default admin/admin on unconfigured units) sends a crafted HTTP POST request to /goform/formResetStatistic with an oversized status_statistic value, overflowing the stack buffer in formResetStatistic and overwriting the saved return address. With the published PoC available on GitHub, the attacker can adapt it to crash the device for denial of service or, with additional ROP/shellcode tailoring for the device's MIPS/ARM binary, achieve code execution as the web server process and pivot to LAN-side hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Stack-based buffer overflow in TRENDnet TEW-432BRP router (firmware 3.10B20) allows authenticated remote attackers to corrupt memory via the status_statistic parameter in the /goform/formResetStatistic endpoint, potentially leading to code execution or device compromise. Publicly available exploit code exists on GitHub, and the vendor has confirmed the product is end-of-life (EOL since 2009) and will not be patched. No CISA KEV listing or EPSS data is provided in the input, so widespread exploitation status is unconfirmed.
Earlier versions of this analysis (2)
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router allows remote authenticated attackers to corrupt memory by manipulating the status_statistic parameter in the formResetStatistic handler at /goform/formResetStatistic. Publicly available exploit code exists and the device is end-of-life since 2009, meaning the vendor has explicitly refused to issue a fix. The vulnerability carries a CVSS 4.0 score of 7.4 with high confidentiality, integrity, and availability impact.
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 wireless router allows remote authenticated attackers to corrupt memory and likely achieve arbitrary code execution via the status_statistic parameter in the /goform/formResetStatistic endpoint. Publicly available exploit code exists on GitHub, and the vendor has explicitly refused to issue a fix because the device has been end-of-life since 2009, leaving all deployed units permanently vulnerable.
RemediationAI
No vendor-released patch identified at time of analysis - TRENDnet has formally declined to fix this issue because the TEW-432BRP has been EOL since 2009, so the only durable remediation is to decommission and replace the device with a currently supported router. As compensating controls until replacement, disable remote/WAN-side management of the web administration interface so /goform/formResetStatistic is not reachable from the internet (this prevents remote configuration but eliminates the WAN attack surface), restrict LAN access to the admin UI by ACL or VLAN segmentation to a dedicated management host (trade-off: loses ad-hoc management convenience), and change the default administrative credentials to a strong unique password since the CVSS PR:L requirement means valid auth is needed to invoke formResetStatistic. The public exploit details at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_14/14.md should be reviewed by defenders to build IDS/IPS signatures targeting oversized status_statistic POST bodies against /goform/formResetStatistic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is a legacy TRENDnet TEW-432BRP SOHO wireless router whose web management interface uses the common embedded-Linux 'goform' CGI handler pattern. The vulnerable function formResetStatistic processes the status_statistic argument without adequate bounds checking, matching CWE-121 (Stack-Based Buffer Overflow), where attacker-supplied input overruns a fixed-size stack buffer and can overwrite the saved return address or adjacent stack control data. Such embedded MIPS/ARM router binaries typically lack modern exploit mitigations (often no ASLR, no stack canaries, NX inconsistently applied), making stack overflows in goform handlers a well-documented route to reliable code execution on this class of device. The CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:* indicates all firmware revisions of this model are presumed affected.
Know when Tew 432Brp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
The TRENDnet TEW-432BRP router contains a memory corruption vulnerability that could allow authenticated administrators or attackers with compromised credentials to execute code and compromise device operations; publicly available exploit code exists for this vulnerability. The vendor declared this product end-of-life in 2009 and will not patch it, leaving organizations with a permanent security exposure that can only be resolved through hardware replacement.
No vendor-released patch identified at time of analysis; recommended mitigations include: network segmentation isolating affected devices from critical infrastructure and sensitive data; restriction of administrative access to trusted internal networks; disabling of remote management; active monitoring for unauthorized access attempts; hardware replacement with supported router products.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in TRENDnet TEW-432BRP Stack Buffer Overflow Flaws
View all 5More in Tew 432Brp
View allStack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router allows remote attackers with low privileges to corrupt
Stack-based buffer overflow in TRENDnet TEW-432BRP wireless router firmware 3.10B20 allows remote authenticated attacker
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows authenticated remote attackers to corr
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 routers allows authenticated remote attackers to corrupt memo
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows remote authenticated attackers to corr
Stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router (firmware 3.10B20) allows remote authenticated at
Stack-based buffer overflow in TRENDnet TEW-432BRP 3.10B20 router firmware allows authenticated remote attackers to corr
Exploit-DB