EXPOSURES › CVE-2026-109157
CVE-2026-109157
CRITICALTRENDnet's 2011 EOL router has a remotely exploitable stack buffer overflow in an unpatched, unsupported product.
TRENDnet's TEW-432BRP router, EOL since 2011, contains a stack-based buffer overflow in formTcpipSetup that can be triggered remotely. DIB orgs must care because deploying or maintaining legacy hardware violates NIST 800-171's requirement to patch known vulnerabilities and manage supply chain risk. The vendor admits it cannot test the fix due to EOL status, leaving the device permanently vulnerable to remote code execution.
Shame score — TRENDnet shipped an unpatched, remotely exploitable vulnerability in a product EOL over a decade ago, demonstrating a complete failure of the supply chain to maintain secure, supported hardware.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer.