PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10158 TRENDnet CVE debrief

A stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router permits remote, unauthenticated attackers to execute arbitrary code via a crafted `server_name` parameter in the `/goform/formPortFw` endpoint. The vendor has explicitly declined to issue a fix, noting the product reached end-of-life in 2009 (15 years prior to disclosure) and that it cannot replicate or remediate vulnerabilities for unsupported hardware. Public exploit availability elevates practical risk despite the aged target base.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations with legacy TRENDnet TEW-432BRP deployments, managed service providers maintaining aged client infrastructure, and security teams responsible for IoT/OT asset inventory and network segmentation.

Technical summary

The TRENDnet TEW-432BRP firmware version 3.10B20 contains a stack-based buffer overflow in the `formPortFw` function within `/goform/formPortFw`. The `server_name` argument is not properly bounds-checked, allowing an attacker to overwrite the stack and achieve remote code execution. The attack requires network reachability to the router's web interface and no authentication is needed. The product has been end-of-life since 2009; the vendor has stated it cannot reproduce or fix the flaw. A public exploit is available, increasing the likelihood of active targeting in environments where these devices remain deployed.

Defensive priority

HIGH

Recommended defensive actions

  • Remove TRENDnet TEW-432BRP devices from all production, guest, or management networks immediately; no patch will be issued.
  • Block or restrict access to device management interfaces (TCP 80/443 and any custom admin ports) at network perimeters; do not expose to untrusted networks.
  • Inspect network traffic and logs for requests to `/goform/formPortFw` with oversized or anomalous `server_name` values as potential exploitation indicators.
  • Replace affected devices with actively supported routers and confirm vendor security update policies before procurement.
  • Segment legacy IoT networks with strict egress filtering and monitor for unexpected outbound connections from EOL device subnets.

Evidence notes

Vuldb CNA references confirm the vulnerable function `formPortFw`, the affected argument `server_name`, and stack-based buffer overflow classification (CWE-121). CVSS 4.0 vector from NVD source metadata indicates network attack vector, low attack complexity, no required privileges, and high impacts to confidentiality, integrity, and availability. Vendor EOL statement is reproduced in the CVE description field.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10158 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10158

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10158 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10158

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.