CVE-2026-10119: TRENDnet TEW-432BRP formSetMACFilter stack-based overflow

Synopsis

This is a stack-based buffer overflow in the formSetMACFilter handler (/goform/formSetMACFilter) of the TRENDnet TEW-432BRP router, reachable over the network by an attacker holding any low-privilege account on the device. Oversizing the filter_name argument corrupts the stack and lets the attacker fully compromise confidentiality, integrity, and availability of the router, typically resulting in remote code execution on the embedded firmware. The device has been end-of-life since 2009 and TRENDnet has stated it will not issue a fix; HarborGuard tracks the advisory and will make a patched rebuild available the moment any upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network (AV:N).

• AuthenticationRequired

  PR:L indicates any low-privilege account on the device is sufficient to invoke the vulnerable form handler.

• Victim interactionNot required

  UI:N: no user has to click or open anything for the exploit to fire.

• Attack complexityDetail

  AC:L: the overflow is reliable and has no environmental preconditions, and a public exploit is already disclosed.

Blast Radius

• Executes attacker-controlled code in the router's web server process, typically running with full firmware privileges.
• Reads any credentials, Wi-Fi keys, and configuration stored on the device.
• Modifies routing, DNS, firewall, and MAC filter rules to redirect or intercept traffic from every client behind the router.
• Crashes or bricks the device, taking the local network offline.