CVE-2026-10122: TRENDnet TEW-432BRP Buffer Overflow Flaw

CVE-2026-10122 Overview

CVE-2026-10122 is a stack-based buffer overflow [CWE-119] in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. The flaw resides in the formSetProtocolFilter function exposed through the /goform/formSetProtocolFilter endpoint. Manipulating the protocol_name argument overflows a fixed-size stack buffer, corrupting adjacent stack memory and the saved return address. The vulnerability is remotely reachable over the network and a public exploit has been disclosed. TRENDnet has confirmed that the TEW-432BRP reached end-of-life (EOL) in 2009 and will not receive a fix.

Critical Impact
Remote attackers with low privileges can corrupt stack memory on the router and may achieve arbitrary code execution against an unpatched, EOL device.

Affected Products

TRENDnet TEW-432BRP wireless router (EOL since 2009)
Firmware version 3.10B20
Web management interface handler formSetProtocolFilter at /goform/formSetProtocolFilter

Discovery Timeline

2026-05-30 - CVE-2026-10122 published to the National Vulnerability Database (NVD)
2026-06-03 - Last updated in NVD
2026-06-04 - EPSS scoring recorded

Technical Details for CVE-2026-10122

Vulnerability Analysis

The TEW-432BRP web management daemon implements a CGI-style handler named formSetProtocolFilter that processes protocol filter rules submitted from the administrative interface. The handler reads the protocol_name parameter from the incoming HTTP POST body and copies it into a fixed-size buffer allocated on the stack. No length validation is performed before the copy, so an oversized protocol_name value writes past the buffer boundary into adjacent stack frames.

Because the device is classified by the vendor as end-of-life since 2009, no firmware update will be issued. The vulnerability is permanent for the affected hardware. A public proof-of-concept has been disclosed through the GitHub vulnerability documentation and tracked in VulDB #367299.

Root Cause

The root cause is an unbounded string copy of attacker-controlled HTTP form input into a stack buffer inside formSetProtocolFilter. The handler trusts the size of the protocol_name field without enforcing a maximum length or using a bounded copy routine such as strncpy or snprintf. This pattern is characteristic of legacy embedded web stacks compiled without modern stack canaries or address space layout randomization (ASLR).

Attack Vector

An attacker with authenticated access to the router's web interface, or any actor able to reach the management UI from a routable network, can send a crafted POST request to /goform/formSetProtocolFilter with an oversized protocol_name value. The overflow corrupts the saved return address on the MIPS-class embedded stack, enabling control-flow hijack. Successful exploitation can lead to arbitrary code execution on the router with the privileges of the web server process, typically root on consumer routers. Since the device is exposed on the LAN and often reachable from compromised internal hosts, the flaw is a viable pivot point for lateral movement.

No verified exploit code is reproduced here. Refer to the GitHub disclosure for the technical write-up.

Detection Methods for CVE-2026-10122

Indicators of Compromise

HTTP POST requests to /goform/formSetProtocolFilter containing unusually long protocol_name values, especially payloads exceeding 64 bytes
Unexpected reboots, crashes, or watchdog resets of the TEW-432BRP coinciding with inbound web management traffic
Outbound connections originating from the router to unfamiliar external hosts, suggesting post-exploitation implants
Changes to firewall, DNS, or routing configuration not initiated by an administrator

Detection Strategies

Inspect HTTP request bodies destined for the router management interface for overlong parameter values, particularly protocol_name
Apply intrusion detection system (IDS) signatures that flag requests to /goform/formSetProtocolFilter with payload sizes inconsistent with legitimate UI submissions
Correlate router crashes with preceding management-plane HTTP traffic to surface exploitation attempts

Monitoring Recommendations

Forward router syslog and management-plane access logs to a centralized data lake for retention and correlation
Baseline normal administrative traffic to the device so anomalous POST volumes or sources stand out
Alert on any management-interface access originating from non-administrative VLANs or external IP ranges

How to Mitigate CVE-2026-10122

Immediate Actions Required

Replace the TRENDnet TEW-432BRP with a currently supported router that receives security updates from its vendor
If immediate replacement is not possible, isolate the device on a dedicated VLAN and block inbound access to the management interface from untrusted networks
Disable remote management (WAN-side administration) and restrict LAN-side management to a single hardened administrative host
Rotate administrative credentials and any credentials that traversed the device, since router compromise can expose passing traffic

Patch Information

No patch is available. TRENDnet has stated: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." The only supported remediation is device replacement.

Workarounds

Place the router behind a network segmentation boundary that filters HTTP/HTTPS traffic to its management interface
Use an upstream firewall to drop POST requests to /goform/formSetProtocolFilter from any source other than approved administrative endpoints
Power off and decommission the device if it is no longer required for production use

bash

# Example upstream firewall rule to block management access to the EOL router
# Replace 192.0.2.10 with the router IP and 10.0.0.5 with the admin workstation
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -s 10.0.0.5 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP