CVE-2026-10183: TRENDnet TEW-432BRP formWlanSetup stack-based overflow

Synopsis

A stack-based buffer overflow exists in the TRENDnet TEW-432BRP wireless router (firmware 3.10B20), specifically in the formWlanSetup handler exposed via the /goform/formWlanSetup endpoint. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, and no victim interaction is needed. Successful exploitation gives an attacker full read and write access to the device and can crash it; no patch will be issued because TRENDnet declared the hardware end-of-life in 2009. HarborGuard tracks this advisory and will make a patched rebuild available if upstream ever publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the device's web interface.

• AuthenticationRequired

  A low-privilege authenticated account on the device is sufficient to reach the formWlanSetup handler and trigger the overflow.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker sends a crafted request directly.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental factors required; a public exploit is already available.

Blast Radius

• Reads device configuration including stored wireless credentials and any session tokens managed by the router firmware.
• Overwrites stack memory to redirect execution, enabling arbitrary code execution at the privilege level of the web server process.
• Crashes the formWlanSetup handler or the broader web management service, disrupting device administration and potentially causing a full device restart.
• Because the device acts as a network gateway, a compromised router can be used to intercept or redirect traffic for all hosts on the connected LAN segment.