CVE-2026-10062: TRENDnet TEW-432BRP formSetRoute stack-based overflow

Synopsis

A stack-based buffer overflow in the formSetRoute handler (/goform/formSetRoute) of the TRENDnet TEW-432BRP router lets an authenticated remote attacker corrupt stack memory by supplying oversized ip, mask, or gateway arguments. The flaw is reachable over the network with any low-privilege account, requires no victim interaction, and successful exploitation gives full read, write, and crash impact on the device, typically leading to code execution on the router. The vendor has declared the product end-of-life since 2009 and will not issue a fix; HarborGuard tracks the advisory for any future patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network (AV:N).

• AuthenticationRequired

  A low-privilege account on the device is sufficient to invoke formSetRoute (PR:L).

• Victim interactionNot required

  No user action is needed; the attacker drives the exploit directly against the endpoint (UI:N).

• Attack complexityDetail

  Attack complexity is low and a public exploit exists, so the overflow is reliably triggerable without environmental tuning (AC:L).

Blast Radius

• Overwrites the stack of the router's web service, giving control of execution flow and typically full code execution on the device.
• Reads any configuration, credentials, and traffic-handling state held in router memory (VC:H).
• Modifies routing tables, firewall rules, DNS settings, and other persisted device configuration (VI:H).
• Crashes or bricks the router, disrupting all network traffic that depends on it (VA:H).