CVE-2026-10120: TRENDnet TEW-432BRP Buffer Overflow Flaw

CVE-2026-10120 Overview

CVE-2026-10120 is a stack-based buffer overflow [CWE-119] in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. The flaw resides in the formSetFirewallRule function exposed through /goform/formSetFirewallRule. Attackers manipulate the firewall_name argument to overflow a fixed-size stack buffer. The attack can be executed remotely against the device's web management interface. A public exploit exists, increasing the risk of opportunistic abuse. TRENDnet has declared the product end-of-life since 2009 and will not issue a fix. This vulnerability only affects products no longer supported by the vendor.

Critical Impact
Remote authenticated attackers can corrupt stack memory on affected TRENDnet TEW-432BRP routers, potentially leading to arbitrary code execution or device compromise. No vendor patch will be released.

Affected Products

TRENDnet TEW-432BRP wireless router
Firmware version 3.10B20
End-of-life since 2009 (no vendor support)

Discovery Timeline

2026-05-30 - CVE-2026-10120 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10120

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. The affected component is the formSetFirewallRule handler reached through the HTTP endpoint /goform/formSetFirewallRule. This handler processes firewall rule submissions from the router's web administration interface.

The firewall_name POST parameter is copied into a fixed-size stack buffer without length validation. An attacker who submits an oversized value writes past the buffer boundary and corrupts adjacent stack memory, including the saved return address. On embedded MIPS or ARM platforms typical of this device class, attackers can leverage the corruption to redirect execution flow.

The attack requires network reachability to the router's management interface and low-privileged access, as indicated by the CVSS vector component PR:L. Successful exploitation impacts confidentiality, integrity, and availability of the device. Because the product has been end-of-life since 2009, no firmware update will address the issue.

Root Cause

The root cause is the absence of bounds checking when the firewall_name HTTP parameter is copied into a stack-allocated buffer inside formSetFirewallRule. The code path uses unsafe string copy operations without enforcing maximum length, allowing user-controlled input to overflow the destination buffer.

Attack Vector

The attack vector is the network-accessible web management interface. An attacker authenticates to the router's HTTP administration interface, then submits a crafted POST request to /goform/formSetFirewallRule containing an oversized firewall_name value. The overflow occurs during request processing on the device.

The vulnerability mechanism is documented in the public GitHub Vulnerability Details and VulDB Vulnerability #367297. A public proof-of-concept is referenced in those advisories.

Detection Methods for CVE-2026-10120

Indicators of Compromise

HTTP POST requests to /goform/formSetFirewallRule containing unusually long firewall_name parameter values exceeding typical user input sizes.
Unexpected reboots, web interface crashes, or service interruptions on TRENDnet TEW-432BRP devices following administrative requests.
Outbound connections from the router to unknown hosts, suggesting post-exploitation command-and-control activity.
Unauthorized firewall rule changes or configuration drift on legacy TRENDnet devices.

Detection Strategies

Inspect web server and proxy logs for POST requests targeting /goform/formSetFirewallRule with payload sizes outside normal operating ranges.
Deploy network intrusion detection signatures that flag HTTP requests to TRENDnet goform endpoints with parameter values exceeding 256 bytes.
Monitor router-originated network traffic for behavioral anomalies, including DNS queries to suspicious domains or unexpected outbound TCP connections.

Monitoring Recommendations

Forward router syslog and authentication events to a centralized logging platform and alert on repeated administrative requests.
Apply network segmentation so legacy TRENDnet devices cannot reach internal sensitive resources, and monitor traffic crossing those segment boundaries.
Track device firmware versions and management interface exposure through periodic network scans to identify end-of-life hardware still in production.

How to Mitigate CVE-2026-10120

Immediate Actions Required

Replace the TRENDnet TEW-432BRP with a currently supported router, as TRENDnet has confirmed no fix will be issued for this end-of-life product.
Disable remote management on the WAN interface immediately and restrict the web administration interface to a dedicated management VLAN.
Change default and weak administrator credentials, since exploitation requires authenticated access to the management interface.
Isolate the device behind a supported firewall and treat it as untrusted infrastructure until decommissioned.

Patch Information

No patch is available. TRENDnet stated: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." Replacement of the affected hardware is the only complete remediation. Refer to the VulDB Vulnerability #367297 record for ongoing tracking.

Workarounds

Restrict access to the router's web administration interface using upstream firewall rules permitting only specific trusted management IP addresses.
Disable HTTP administration entirely if the device supports CLI or alternative configuration, removing the vulnerable endpoint from exposure.
Place the device on an isolated network segment with strict egress filtering to limit blast radius if the router is compromised.
Plan and execute hardware replacement as the only durable mitigation for unsupported end-of-life equipment.