CVE-2026-10158: TRENDnet TEW-432BRP formPortFw stack-based overflow

Synopsis

A stack-based buffer overflow in the formPortFw handler of the TRENDnet TEW-432BRP router (firmware 3.10B20) lets an attacker overflow a fixed-size stack buffer by supplying an oversized server_name parameter to /goform/formPortFw. The bug is reachable over the network and requires only a low-privilege account on the device's web interface; successful exploitation corrupts the stack and yields full compromise of confidentiality, integrity, and availability on the device, typically as code execution in the web server process. The device is end-of-life and the vendor has stated it will not issue a fix; HarborGuard tracks the advisory and will make a patched rebuild available if an upstream fix is ever published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP management interface over the network (AV:N).

• AuthenticationRequired

  A low-privilege account on the web interface is sufficient to invoke formPortFw (PR:L).

• Victim interactionNot required

  No user action is needed; the attacker hits the endpoint directly (UI:N).

• Attack complexityDetail

  Attack complexity is low and a public exploit has been released, so the overflow triggers reliably without special conditions (AC:L, E:P).

Blast Radius

• Overwrites the stack of the device's web server process, typically enabling arbitrary code execution as the web service account.
• Reads any configuration, credentials, and traffic state held on the router, including Wi-Fi keys and admin credentials.
• Modifies router configuration such as port forwarding, DNS, and firewall rules, allowing pivot into the LAN behind the device.
• Crashes or bricks the web management service and can render the router unavailable until a power cycle or reflash.