PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10120 TRENDnet CVE debrief

A stack-based buffer overflow vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the `formSetFirewallRule` function within the `/goform/formSetFirewallRule` endpoint, where the `firewall_name` parameter is not properly validated before being copied to a fixed-size stack buffer. Successful exploitation allows remote attackers to execute arbitrary code with elevated privileges. The vendor has explicitly stated this product reached end-of-life in 2009 and will not receive patches. Public exploit availability increases immediate risk for any remaining deployed units.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-30
Original CVE updated
2026-07-22
Advisory published
2026-05-30
Advisory updated
2026-07-22

Who should care

Organizations with legacy network infrastructure, SOHO environments with aging equipment, managed service providers maintaining client router fleets, and security teams responsible for IoT/OT asset inventory and lifecycle management.

Technical summary

The `formSetFirewallRule` function in TRENDnet TEW-432BRP firmware 3.10B20 fails to properly bounds-check the `firewall_name` parameter before copying it to a stack-allocated buffer. An authenticated or unauthenticated remote attacker (depending on device configuration) can send a crafted HTTP request to `/goform/formSetFirewallRule` with an oversized `firewall_name` value, triggering stack corruption and potential arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/E:P) reflects network exploitability with public exploit availability and high impacts to confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

  • Immediately inventory all TRENDnet TEW-432BRP devices and remove from production networks
  • Block or restrict access to /goform/formSetFirewallRule at network perimeter if device retirement is not immediately feasible
  • Implement network segmentation to isolate any remaining EOL devices from critical assets
  • Monitor for suspicious traffic targeting goform endpoints on legacy TRENDnet device IP ranges
  • Replace with actively supported router hardware from vendor with security update commitment

Evidence notes

Vulnerability disclosed via VulDB with public proof-of-concept. Vendor confirmed EOL status and no remediation planned. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10120 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10120

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10120 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10120

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.