CVE-2026-10063: TRENDnet TEW-432BRP formWPS stack-based overflow

Synopsis

This is a stack-based buffer overflow in the formWPS handler of the TRENDnet TEW-432BRP router, reached over the network via the /goform/formWPS endpoint by manipulating the peerPin argument. Exploitation requires a low-privilege account on the device's web interface and no victim interaction, and a working exploit is publicly available; successful exploitation corrupts the stack and can lead to arbitrary code execution on the device with full impact to confidentiality, integrity, and availability. The product has been end-of-life since 2009 and the vendor has stated no fix will be issued; HarborGuard tracks the advisory for any future patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network to post to /goform/formWPS.

• AuthenticationRequired

  A low-privilege account on the device's web interface is sufficient to invoke the vulnerable handler.

• Victim interactionNot required

  No user action is needed; the attacker drives the exploit directly against the endpoint.

• Attack complexityDetail

  Attack complexity is low and a public exploit exists, making the overflow reliable to trigger.

Blast Radius

• Overwrites the stack in the formWPS handler and enables arbitrary code execution in the router's web service context.
• Reads device configuration, stored credentials, and WPS/Wi-Fi secrets handled by the management interface.
• Modifies router configuration, firewall rules, DNS settings, and routing behavior, enabling traffic interception or redirection of clients behind the device.
• Crashes or hangs the management service and can render the router unavailable until reboot or reflash.