TRENDnet TEW-635BRM EUVD-2026-43202

Exploitation requires the attacker to reach the device's embedded web service and to hold low-level authenticated access (CVSS PR:L) sufficient to submit the device_name argument that the start_httpd function in /sbin/rc processes; the concrete trigger is supplying an over-long device_name value to that web configuration handler. Limiting factors: the attacker needs valid (low-privilege) credentials or an authenticated session to the management interface rather than pure unauthenticated access, and the network path to the HTTP management service must be reachable - internet exposure is only likely where remote/WAN administration is enabled, otherwise LAN or adjacent-network positioning is required. The flaw is confined to the specific, end-of-life TEW-635BRM firmware up to 1.00.03, so realistic exposure is bounded by how many of these discontinued 2011-era units remain deployed and reachable.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, indicating network-reachable, low-complexity exploitation requiring low privileges (PR:L) and yielding high impact to confidentiality, integrity, and availability of the device itself (no scope change to other systems). The E:P exploit-maturity metric and the referenced GitHub proof-of-concept confirm publicly available exploit code exists, but the vulnerability is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - treat this as demonstrated-but-not-confirmed-exploited. The most important real-world modifier is that this product is end-of-life since 2011 and unsupported: no patch will ever ship, which raises long-term risk for any still-deployed units, but the deployment footprint of a 15-year-old discontinued home router is very small, bounding aggregate risk. The PR:L requirement (attacker needs some authenticated access to the web service) is a meaningful limiter that should temper prioritization versus an unauthenticated flaw. Note the vendor explicitly states it cannot confirm the vulnerability exists, so affected-version and impact details rest on the VulDB researcher submission rather than independent vendor validation.

An attacker who has obtained low-privilege access to the router's web management interface (for example via default or weak credentials on an internet-exposed or LAN-adjacent device) submits a crafted device_name value that exceeds the target stack buffer processed by start_httpd, overwriting the saved return address and redirecting execution to injected shellcode. Because a public proof-of-concept is available on GitHub and attack complexity is low (AC:L), a moderately skilled attacker could reproduce full compromise of the device and pivot into the internal network.