TRENDnet TEW-432BRP EUVD-2026-33505

Exploitation requires network reachability to the device's HTTP administration interface and an authenticated session sufficient to invoke /goform/formWlanSetup (CVSS PR:L), so the attacker must have either valid admin credentials, default/unchanged credentials, a hijacked session, or LAN-side access where the panel is exposed without strong auth. No user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors: the vulnerability is in the WLAN-setup handler specifically on TRENDnet TEW-432BRP firmware 3.10B20, so exploitation is constrained to this EOL hardware model, and any deployment that places the admin interface behind a management VLAN or disables WAN-side admin meaningfully reduces external reachability.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 (High), reflecting network reach, low complexity, and full confidentiality/integrity/availability impact on the vulnerable component, but PR:L indicates some authentication or session context is required, which limits drive-by exploitation. The E:P value confirms a proof-of-concept exists (matching the public GitHub PoC), and the device is not in CISA KEV, so this is best treated as opportunistic/targeted-research risk rather than mass-exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The most decisive risk signal is operational, not numeric: the vendor has formally refused to fix because the product has been EOL since 2009, so any deployed unit is a permanent unpatched attack surface - particularly dangerous if the admin interface is reachable from the WAN or from a guest WLAN segment.

An attacker who has reached the router's web administration interface - for example, a malicious user on the LAN/WLAN, or an external attacker against a unit with WAN-side admin enabled or default credentials - sends a crafted POST to /goform/formWlanSetup with an oversized 'enrollee' value, overwriting the saved return address on the stack. Because the public PoC at github.com/wudipjq/my_vuln demonstrates the crash and offset, weaponization to a working root shell on this mitigation-free MIPS/ARM firmware is well within reach of a moderately skilled attacker. Successful exploitation yields code execution as the httpd user (typically root on this device class), giving the attacker full control of routing, DNS, and traffic interception.