CVE-2026-10161 Overview
CVE-2026-10161 is a stack-based buffer overflow vulnerability in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. The flaw resides in the formResetStatistic function within /goform/formResetStatistic, where manipulation of the status_statistic argument triggers memory corruption [CWE-119]. An attacker reachable over the network can exploit the issue remotely, and public exploit details are available.
TRENDnet has confirmed the device has been end-of-life since 2009 and will not receive a fix. Organizations still operating this hardware should retire or isolate it immediately.
Critical Impact
Remote attackers with low-privilege access can corrupt the router's stack memory through the status_statistic parameter, enabling potential code execution or device compromise on an unsupported product that will never receive a patch.
Affected Products
- TRENDnet TEW-432BRP wireless router
- Firmware version 3.10B20
- End-of-life since 2009 — no patched versions available
Discovery Timeline
- 2026-05-31 - CVE-2026-10161 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10161
Vulnerability Analysis
The vulnerability affects the web administration interface of the TEW-432BRP router. The formResetStatistic handler, accessible via /goform/formResetStatistic, processes the status_statistic HTTP parameter without enforcing a bounds check before copying data into a fixed-size stack buffer. Supplying an oversized value overruns adjacent stack memory.
Stack-based buffer overflows of this class can overwrite saved return addresses and function pointers on the device's MIPS or ARM stack, depending on the firmware build. Successful exploitation can crash the router or redirect execution flow to attacker-controlled shellcode. Because the device is end-of-life, no compensating controls exist at the firmware level.
The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Public proof-of-concept details are referenced in the GitHub vulnerability documentation and the VulDB #367414 entry.
Root Cause
The root cause is the absence of input length validation on the status_statistic parameter inside formResetStatistic. The handler trusts client-supplied data and copies it into a stack buffer using an unbounded string operation. Legacy firmware compiled without stack canaries or ASLR amplifies the impact of the overflow.
Attack Vector
An authenticated attacker on the same network as the router sends a crafted HTTP POST request to /goform/formResetStatistic containing an oversized status_statistic value. The request reaches the embedded HTTP server, which dispatches to the vulnerable handler. The overflow corrupts the stack and can hijack control flow on the embedded device.
No synthetic exploit code is reproduced here. Researchers documenting the issue have published technical proof-of-concept information at the references above.
Detection Methods for CVE-2026-10161
Indicators of Compromise
- HTTP POST requests to /goform/formResetStatistic containing unusually long status_statistic parameter values
- Unexpected reboots, crashes, or watchdog resets on TEW-432BRP devices
- Outbound connections from the router to unknown hosts following administrative interface access
- DNS, routing, or firewall rule changes that were not made by administrators
Detection Strategies
- Inspect network traffic to administrative interfaces of legacy routers and alert on oversized POST bodies targeting /goform/ endpoints
- Deploy intrusion detection signatures that flag HTTP requests with status_statistic parameter lengths exceeding typical bounds
- Correlate router management-plane traffic with originating client identity to identify unauthorized administrative sessions
Monitoring Recommendations
- Forward syslog and HTTP access logs from perimeter routers into a centralized log platform for retention and analysis
- Monitor for new or unauthorized devices acting as gateways on segments where TEW-432BRP hardware was historically deployed
- Track DNS resolution patterns from internal clients for signs of router-level DNS hijacking
How to Mitigate CVE-2026-10161
Immediate Actions Required
- Identify and inventory any remaining TRENDnet TEW-432BRP devices in the environment
- Decommission and replace the hardware with a currently supported router that receives security updates
- If immediate replacement is not possible, restrict management interface access to a dedicated administrative VLAN
- Rotate any credentials that were configured on or transited through the affected device
Patch Information
No patch is available. TRENDnet has stated the product has been end-of-life since 2009 and the vendor will not replicate or fix vulnerabilities in this device. Retirement is the only complete remediation.
Workarounds
- Disable remote administration on the WAN interface and restrict LAN-side admin access by source IP
- Place the router behind a supported firewall and block inbound access to /goform/ URIs from untrusted networks
- Segment the router onto an isolated network with no access to sensitive internal resources until it is replaced
# Example firewall rule to block external access to the vulnerable endpoint
# Adjust interface and source ranges to match your environment
iptables -A FORWARD -p tcp --dport 80 -d <router_ip> \
-m string --string "/goform/formResetStatistic" --algo bm -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
