CVE-2026-10123

Vulnerability

A stack-based buffer overflow vulnerability exists in the formSetDomainFilter function of the TRENDnet TEW-432BRP router firmware version 3.10B20. The function is accessible via the /goform/formSetDomainFilter endpoint and accepts the arguments blocked_domain, permitted_domain, blocked_domain_list, and permitted_domain_list without proper length validation. When an attacker supplies overly long input for any of these parameters, the data is copied directly to a local stack buffer, overwriting the return address and causing a buffer overflow [1].

Exploitation

An unauthenticated remote attacker can trigger the vulnerability by sending a crafted POST request to /goform/formSetDomainFilter with a long string in one of the vulnerable parameters (e.g., blocked_domain_list). The public proof-of-concept demonstrates a crash by sending a string of repeated a characters; an attacker can control the overflow to achieve arbitrary code execution. The router uses default credentials (admin:admin), making the attack trivial if the device is exposed [1].

Impact

Successful exploitation allows an attacker to cause a denial of service (device crash) or execute arbitrary code with root privileges on the router. This can lead to full compromise of the network device, enabling data exfiltration, malware installation, or use as a pivot point for further attacks. The product is end-of-life, so no security updates will be provided [1].

Mitigation

The vendor has confirmed that the TRENDnet TEW-432BRP has been end-of-life since 2009 and will not release a patch for this vulnerability. No workaround is available. The only effective mitigation is to replace the device with a supported model that receives security updates. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.