CVE-2026-10121 Overview
CVE-2026-10121 is a stack-based buffer overflow in the TRENDnet TEW-432BRP wireless router, firmware version 3.10B20. The flaw resides in the formSetUrlFilter function within /goform/formSetUrlFilter. Improper handling of the keyword_list and keyword arguments allows an authenticated remote attacker to corrupt the stack. A public exploit has been disclosed, increasing the risk of opportunistic attacks against exposed devices. The vendor has stated the product reached end-of-life (EOL) in 2009 and will not receive a patch. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Remote attackers with low-privilege access can trigger memory corruption in the router's web management interface, potentially leading to arbitrary code execution or device compromise on unsupported hardware that will never receive a fix.
Affected Products
- TRENDnet TEW-432BRP wireless router
- Firmware version 3.10B20
- End-of-life since 2009 — no patches will be released
Discovery Timeline
- 2026-05-30 - CVE-2026-10121 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10121
Vulnerability Analysis
The vulnerability is a classic stack-based buffer overflow (CWE-119) in the router's HTTP management interface. The formSetUrlFilter handler processes URL filtering rules submitted via the web UI. The handler reads the keyword_list and keyword POST parameters and copies attacker-controlled data into a fixed-size stack buffer without enforcing length checks. Supplying an oversized value corrupts adjacent stack memory, including saved return addresses and frame pointers. This is a network-exploitable condition (AV:N) with low attack complexity and a publicly available proof of concept. Because TRENDnet has confirmed the device is EOL, the issue is permanently unpatched on affected hardware.
Root Cause
The root cause is the absence of bounds checking when copying request parameters into a stack buffer. The formSetUrlFilter function trusts the size of the keyword_list and keyword fields supplied through /goform/formSetUrlFilter. Standard mitigations such as stack canaries, ASLR, and non-executable stacks are typically absent on legacy embedded MIPS-class consumer routers from this era, which amplifies exploitability.
Attack Vector
An attacker with valid administrative credentials—or access to a device using default credentials—sends a crafted HTTP POST request to /goform/formSetUrlFilter containing an overlong keyword_list or keyword parameter. The malformed request triggers stack corruption inside the embedded web server. Successful exploitation can crash the device or, with reliable gadget chaining, redirect control flow. Devices exposed to the WAN through remote management or port-forwarding rules are at greatest risk.
No verified exploit code is included here. Refer to the GitHub Vulnerability Report and VulDB #367298 for the published technical analysis and proof of concept.
Detection Methods for CVE-2026-10121
Indicators of Compromise
- Unexpected reboots or crashes of the TEW-432BRP web management daemon following inbound HTTP traffic.
- HTTP POST requests to /goform/formSetUrlFilter containing abnormally long keyword or keyword_list values.
- Outbound connections from the router to unknown command-and-control infrastructure after administrative interface activity.
Detection Strategies
- Inspect network traffic for POST requests targeting /goform/formSetUrlFilter with parameter values exceeding typical URL-filter keyword lengths (for example, more than 128 bytes).
- Correlate router management traffic with subsequent device unavailability or firmware integrity changes.
- Use IDS/IPS signatures targeting the formSetUrlFilter endpoint pattern with anomalous payload sizes.
Monitoring Recommendations
- Monitor administrative access to legacy router web interfaces from internal hosts and the WAN side.
- Log and alert on devices identifying themselves as TEW-432BRP in DHCP fingerprinting or SNMP discovery scans.
- Track failed and successful logins to embedded device management portals through upstream network logs.
How to Mitigate CVE-2026-10121
Immediate Actions Required
- Replace the TRENDnet TEW-432BRP with a currently supported router. The vendor has confirmed no fix will be issued.
- Disable remote (WAN) management on the device immediately if replacement is not yet possible.
- Change any default or reused administrative credentials and restrict LAN-side access to the management interface.
Patch Information
No patch is available. TRENDnet has publicly stated the TEW-432BRP has been end-of-life since 2009 and the vendor cannot reproduce or remediate vulnerabilities in this product. The only durable remediation is decommissioning the device. See VulDB #367298 for the vendor statement and technical details.
Workarounds
- Place the router behind a network segment that blocks untrusted hosts from reaching its web management interface on TCP/80 and TCP/443.
- Disable the URL filtering feature within the device's web UI to reduce exposure of the formSetUrlFilter handler.
- Apply ACLs on upstream firewalls to drop inbound traffic destined for /goform/formSetUrlFilter on the router's management IP.
# Example upstream firewall rule (iptables) blocking external access to the router management interface
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
