CVE-2026-10123: Fourth Stack Overflow in a Week Confirms Widespread Firmware Failure in TRENDnet…

A fourth stack-based buffer overflow disclosed in this same week-long wave targets the domain filtering feature of the TRENDnet TEW-432BRP, cementing a clear pattern of systemic memory-safety failures across the router's entire web management interface.[mondoo]

What Is the TRENDnet TEW-432BRP

The TEW-432BRP running firmware 3.10B20 has now accumulated at least five related CVEs in a single disclosure batch, all sharing the identical unsafe input-handling pattern across different configuration features. This particular flaw affects the device's domain filtering capability, following the same trajectory as the firewall, URL filter, and protocol filter overflows disclosed alongside it.[cvefeed]

The Vulnerability Explained

This flaw resides in the formSetDomainFilter function, reachable through the /goform/formSetDomainFilter endpoint. The function processes four separate arguments, blocked_domain, permitted_domain, blocked_domain_list, and permitted_domain_list, used to configure domain-based content filtering, but fails to validate the length of any of them before copying the data into a fixed-size stack buffer.[mondoo]

This is now the fourth confirmed instance of the identical weakness class, CWE-121 Stack-based Buffer Overflow alongside the broader CWE-119, found across separate /goform/ endpoints in this one firmware build. Notably, this vulnerability accepts overflow through any of four different parameters rather than just one, widening the practical attack surface for this specific endpoint compared to its siblings.[mondoo]

Severity and Scoring

This entry carries the highest CVSS v4.0 score yet seen across this cluster of related disclosures, reflecting its ability to fully compromise the device with minimal preconditions.

CVSS v4.0 rates the flaw at 8.7, High, using the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P, confirming a network attack vector, low complexity, no attack requirements, low privileges, no user interaction, and high impact on confidentiality, integrity, and availability of the vulnerable system itself. An older CVSS v2.0 assessment scores it at 9.0, High, using the vector AV:N/AC:L/Au:S/C:C/I:C/A:C. The vulnerability was published on May 30, 2026, and last modified two days after initial disclosure, with a public exploit already made available.[dbugs.ptsecurity]

How an Attacker Exploits It

An attacker with low-level access to the router's management interface submits an oversized value in any of the four vulnerable domain-filtering parameters to the /goform/formSetDomainFilter endpoint. Because the firmware performs no length validation on any of these inputs, the overflow corrupts adjacent stack memory, including control-flow structures that govern program execution.[dbugs.ptsecurity]

A carefully constructed payload targeting this overflow can grant an attacker arbitrary code execution on the device, consistent with the high confidentiality, integrity, and availability impact reflected in the CVSS scoring. As with the related flaws in this same batch, the attack requires only network reachability to the management interface and low privileges, making exposed devices realistic remote targets.[mondoo]

A Pattern Now Spanning Five Endpoints

This vulnerability joins at least four sibling disclosures, CVE-2026–10120, CVE-2026–10121, CVE-2026–10122, and an additional overflow found in the formWlanSetup function tracked separately, all sharing the exact same root cause across different /goform/ handlers in the identical firmware build. At this point, the pattern is no longer coincidental: the firmware appears to reuse an unsafe copy routine throughout its entire form-processing codebase, meaning virtually any endpoint accepting free-text input is a plausible candidate for the same defect.[nvd.nist]

Why There Will Never Be a Patch

TRENDnet's vendor response is now recorded verbatim for the fourth time across this disclosure wave: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities". Independent researchers confirm there is no information about any newer firmware version that resolves this specific defect, reinforcing that this device line has been permanently abandoned regardless of how many additional CVEs accumulate against it.[dbugs.ptsecurity]

Remediation Guidance

With no realistic prospect of an official fix arriving after four consecutive confirmations of the same vendor stance, mitigation depends entirely on removing exposure to the affected hardware.

• Treat any TRENDnet TEW-432BRP device on your network as carrying at least five confirmed, permanently unpatched remote code execution vulnerabilities.
• Disable remote or WAN-facing access to the router's management interface without exception.
• Prioritize full replacement of the device over any interim mitigation, given the scale and consistency of the vulnerability pattern.
• If replacement is delayed, isolate the router on a dedicated management VLAN with strict, monitored access controls.
• Assume additional undisclosed /goform/ endpoints on this firmware harbor the same class of vulnerability and audit accordingly if the device must remain in service temporarily.

Why This Matters

A fourth nearly identical stack overflow disclosed within days of the first strongly suggests that this firmware was built without any meaningful boundary checking anywhere in its web-facing configuration code, not just in isolated features. Organizations should treat this accumulating pattern as conclusive evidence that any remaining TEW-432BRP deployment represents an active, unpatchable liability rather than a device worth defending through incremental compensating controls.