CVE-2026-10123: TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow

Synopsis

A stack-based buffer overflow in the formSetDomainFilter handler of the TRENDnet TEW-432BRP router (firmware 3.10B20) is reachable over the network by any authenticated user who can submit oversized values to the blocked_domain, permitted_domain, blocked_domain_list, or permitted_domain_list arguments at /goform/formSetDomainFilter. Successful exploitation corrupts the router's stack and yields full compromise of confidentiality, integrity, and availability on the device, with a public exploit already available. The product has been end-of-life since 2009 and the vendor has stated no fix will be issued; HarborGuard tracks the advisory and will surface a patched rebuild the moment any upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network (AV:N).

• AuthenticationRequired

  A low-privilege account on the router's web UI is sufficient to invoke the vulnerable handler (PR:L).

• Victim interactionNot required

  Exploitation does not require any action from a logged-in administrator or other user (UI:N).

• Attack complexityDetail

  Attack complexity is low and a public exploit exists, so the overflow triggers reliably without environmental tuning (AC:L, E:P).

Blast Radius

• Overwrites the stack of the router's HTTP daemon, enabling arbitrary code execution in the context of the management process.
• Reads any credentials, WPA keys, and configuration secrets stored on the device.
• Modifies routing, DNS, firewall, and domain-filter rules to redirect or intercept downstream client traffic.
• Crashes or bricks the router, taking the network segment behind it offline.