CVE-2026-10123 Overview
CVE-2026-10123 is a stack-based buffer overflow [CWE-119] in the TRENDnet TEW-432BRP wireless router, firmware version 3.10B20. The flaw resides in the formSetDomainFilter function reachable through the /goform/formSetDomainFilter endpoint. Attackers manipulate the blocked_domain, permitted_domain, blocked_domain_list, or permitted_domain_list parameters to overflow a fixed-size stack buffer. The attack is remote and requires only low privileges on the router's web interface. Public exploit details have been released. TRENDnet states the device has been end-of-life since 2009 and will not receive a fix. Affected deployments must rely on compensating controls or device replacement.
Critical Impact
Remote attackers with low-privilege credentials can corrupt router memory, leading to denial of service or potential arbitrary code execution on an unpatched, end-of-life device.
Affected Products
- TRENDnet TEW-432BRP wireless router
- Firmware version 3.10B20
- All devices end-of-life since 2009 — no patch will be issued
Discovery Timeline
- 2026-05-30 - CVE-2026-10123 published to the National Vulnerability Database (NVD)
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10123
Vulnerability Analysis
The TEW-432BRP web management interface exposes the /goform/formSetDomainFilter handler for configuring domain filtering rules. The handler reads the blocked_domain, permitted_domain, blocked_domain_list, and permitted_domain_list HTTP parameters and copies them into stack buffers without validating input length. Supplying an overlong value overruns the buffer and overwrites adjacent stack data, including saved return addresses. The condition matches the classic pattern described by [CWE-119]: improper restriction of operations within the bounds of a memory buffer.
Because this firmware predates modern mitigations such as stack canaries, address space layout randomization (ASLR), and non-executable stacks on most MIPS/ARM SOHO platforms of that era, the overflow path is straightforward to weaponize. Successful exploitation can crash the HTTP daemon or redirect execution to attacker-controlled shellcode, giving a foothold on the LAN edge.
Root Cause
The root cause is missing bounds checking on user-controlled HTTP form fields before they are copied into fixed-size stack buffers inside formSetDomainFilter. The handler trusts client-supplied lengths and performs an unbounded string copy.
Attack Vector
The vulnerability is reachable over the network through the router's web interface. An attacker authenticated as a low-privilege user submits a crafted POST request to /goform/formSetDomainFilter containing an oversized value in one of the four affected parameters. No user interaction is required beyond the initial authenticated request. Routers exposing the management UI to the WAN dramatically increase exposure.
No verified proof-of-concept code is reproduced here. Technical details are available in the GitHub vulnerability documentation and VulDB entry #367300.
Detection Methods for CVE-2026-10123
Indicators of Compromise
- HTTP POST requests to /goform/formSetDomainFilter containing parameter values that exceed typical domain-name lengths (greater than 255 bytes).
- Repeated crashes or unexpected reboots of TEW-432BRP devices following HTTP traffic to the management interface.
- Unauthenticated or unexpected sessions in router admin logs prior to the malformed request.
Detection Strategies
- Inspect network traffic for HTTP requests targeting the /goform/formSetDomainFilter URI from non-administrative sources.
- Apply intrusion detection signatures that flag oversized blocked_domain, permitted_domain, blocked_domain_list, or permitted_domain_list POST parameters.
- Correlate router availability monitoring alerts with concurrent HTTP activity to identify exploitation attempts.
Monitoring Recommendations
- Forward router system and access logs to a centralized log platform and alert on repeated 500-class responses from /goform/ endpoints.
- Monitor egress traffic from the router for unexpected outbound connections that may indicate post-exploitation activity.
- Track DHCP and ARP anomalies on segments where legacy TRENDnet devices remain in service.
How to Mitigate CVE-2026-10123
Immediate Actions Required
- Remove TRENDnet TEW-432BRP devices from production networks and replace them with a currently supported router.
- Disable WAN-side administration on any TEW-432BRP that cannot be retired immediately.
- Rotate the router administrator password and restrict LAN-side management to a dedicated administrative VLAN.
Patch Information
No patch is available. TRENDnet has stated the TEW-432BRP has been end-of-life since 2009 and the vendor will not reproduce or remediate the vulnerability. Continued operation of this device places the network at ongoing risk. Affected customers should plan device replacement.
Workarounds
- Block external access to TCP port 80 and 443 on the router's WAN interface at an upstream firewall.
- Restrict access to /goform/formSetDomainFilter to a single trusted management host using ACLs where supported.
- Place the device behind a network segment that filters HTTP traffic and isolates it from sensitive assets until decommissioned.
# Example upstream firewall rule to block WAN management access to the EOL router
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
