PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10161 TRENDnet CVE debrief

A stack-based buffer overflow vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability is located in the `formResetStatistic` function within the `/goform/formResetStatistic` endpoint. An attacker can trigger the overflow by manipulating the `status_statistic` argument, leading to potential remote code execution. The vendor has explicitly stated this product reached end-of-life in 2009 (15 years ago) and will not provide fixes. The exploit has been publicly disclosed.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations still operating TRENDnet TEW-432BRP routers; network administrators responsible for legacy embedded device inventory; security teams managing IoT/OT network segments with EOL equipment.

Technical summary

The TRENDnet TEW-432BRP 3.10B20 firmware contains a stack-based buffer overflow (CWE-121/CWE-119) in the `formResetStatistic` function of `/goform/formResetStatistic`. The `status_statistic` parameter lacks proper bounds validation, allowing an attacker to overwrite the stack. The attack is remotely exploitable with low complexity and requires low privileges. The vendor confirmed the product has been end-of-life since 2009 with no remediation path.

Defensive priority

critical

Recommended defensive actions

  • Immediately remove TRENDnet TEW-432BRP devices from production networks; no patch will be issued due to 15-year EOL status.
  • Block or restrict access to `/goform/formResetStatistic` at network boundaries if device retirement is not immediately feasible.
  • Monitor network traffic for requests to `/goform/formResetStatistic` containing unusually large or malformed `status_statistic` values.
  • Inventory all TRENDnet TEW-432BRP deployments and prioritize replacement with actively supported routing hardware.
  • Review network segmentation to ensure EOL devices are isolated from critical assets and cannot be reached from untrusted networks.

Evidence notes

The vulnerability was published to NVD on 2026-05-31. The vendor confirmed EOL status with no remediation planned. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction needed. Public exploit availability is indicated by the 'E:P' (Exploit: Proof-of-concept) metric in the CVSS vector.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10161 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10161

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10161 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10161

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.