CVE-2026-5349: Trendnet TEW-657BRM Buffer Overflow Flaw

CVE-2026-5349 Overview

CVE-2026-5349 is a stack-based buffer overflow in the Trendnet TEW-657BRM wireless router running firmware version 1.00.1. The flaw resides in the add_apcdb function within /setup.cgi, where the mac_pc_dba argument is processed without proper bounds checking. An attacker can trigger the overflow remotely over the network with low privileges. Trendnet has confirmed the product reached end-of-life on June 23, 2011, and will not issue a fix. The exploit details are publicly available through VulDB and a GitHub vulnerability writeup, increasing the risk of opportunistic abuse against exposed devices.

Critical Impact
Remote attackers can corrupt stack memory on the router, potentially leading to arbitrary code execution or denial of service. The vendor will not patch this vulnerability because the device is discontinued.

Affected Products

Trendnet TEW-657BRM hardware (end-of-life since June 23, 2011)
Trendnet TEW-657BRM firmware version 1.00.1
All deployments still exposing /setup.cgi to network-reachable clients

Discovery Timeline

2026-04-02 - CVE-2026-5349 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5349

Vulnerability Analysis

The vulnerability is classified as a stack-based buffer overflow under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It is reachable through the router's web management interface at /setup.cgi. When the add_apcdb handler processes the mac_pc_dba parameter, attacker-controlled data is copied into a fixed-size stack buffer without length validation. Overflowing this buffer allows adjacent stack data, including saved return addresses, to be overwritten. On embedded MIPS or ARM devices like the TEW-657BRM, this typically results in process crash or hijacked control flow.

Root Cause

The add_apcdb function uses an unsafe string copy operation on the mac_pc_dba POST parameter. The firmware does not enforce a maximum input length before writing the value into a local stack buffer. Without stack canaries or address space layout randomization on this legacy device, the overflow becomes directly exploitable.

Attack Vector

The attack is network-based and requires the attacker to reach the router's HTTP administrative interface. The CVSS vector indicates low-privilege authentication is required, meaning an attacker needs valid credentials or session access. Attackers who obtain default or weak admin credentials, or who pivot from an internal LAN host, can submit a crafted POST request to /setup.cgi invoking the add_apcdb action with an oversized mac_pc_dba value. Public proof-of-concept information is hosted in the GitHub vulnerability description and the VulDB entry #354702.

No verified exploit code is being reproduced here. Refer to the linked references for technical details on parameter layout and payload construction.

Detection Methods for CVE-2026-5349

Indicators of Compromise

HTTP POST requests to /setup.cgi containing the add_apcdb action with abnormally long mac_pc_dba parameter values
Repeated reboots, watchdog resets, or web service crashes on TEW-657BRM devices
Unexpected outbound connections from the router after administrative requests
Configuration changes to wireless or DHCP settings that were not initiated by authorized administrators

Detection Strategies

Inspect web server and router syslog output for malformed setup.cgi requests and segmentation faults in the HTTP daemon
Deploy network IDS signatures that flag POST bodies to /setup.cgi exceeding expected parameter lengths
Baseline normal administrative traffic to the router and alert on deviations in request size or frequency

Monitoring Recommendations

Forward router and gateway logs to a centralized SIEM for correlation with endpoint and identity telemetry
Monitor management VLANs for any new HTTP client attempting to reach legacy network appliances
Alert on administrative logins to the TEW-657BRM from non-approved source addresses

How to Mitigate CVE-2026-5349

Immediate Actions Required

Replace the Trendnet TEW-657BRM with a currently supported router, since the vendor confirmed no patch will be released
Remove the device from any network segment exposed to the internet and disable WAN-side management immediately
Restrict LAN access to the router's /setup.cgi interface to a dedicated management host or jump server
Change default and reused administrative credentials to long, unique values

Patch Information

No patch is available. Trendnet has stated that the TEW-657BRM was discontinued and reached end-of-life on June 23, 2011, and the vendor will not investigate or remediate vulnerabilities in this product. Customers should treat the device as permanently unsupported and plan hardware replacement.

Workarounds

Place the router behind a firewall that blocks inbound access to TCP/80 and TCP/443 on the device
Disable remote administration features and restrict the admin interface to a single management IP via ACL
Segment the router onto an isolated VLAN and prohibit untrusted clients from reaching its management plane
Decommission the device as soon as a replacement is provisioned

bash

# Example firewall rule to block external access to the legacy router management interface
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP

# Allow only a designated admin host on the LAN to reach the management UI
iptables -I FORWARD -s <admin_host_ip> -d <router_ip> -p tcp --dport 80 -j ACCEPT