CVE-2026–10121: Second Unpatchable Stack Overflow Discovered in TRENDnet TEW-432BRP

Just one endpoint away from a related flaw disclosed in the same batch, another stack-based buffer overflow in the TRENDnet TEW-432BRP router's URL filtering feature confirms this abandoned device has no path to an official fix.[nvd.nist]

What Is the TRENDnet TEW-432BRP

The TEW-432BRP is a consumer wireless broadband router from TRENDnet, still found running firmware version 3.10B20 in various legacy deployments despite being officially discontinued since 2009. This is the second vulnerability disclosed in the same wave affecting this device, following a related overflow in its firewall rule handling under CVE-2026–10120.[nvd.nist]

The Vulnerability Explained

This flaw resides in the formSetUrlFilter function, reachable through the /goform/formSetUrlFilter endpoint on the router's web management interface. The function processes the keyword_list and keyword arguments used to configure URL filtering rules, but fails to properly validate the length of this input before copying it into a fixed-size buffer on the stack.[nvd.nist]

This defect falls under CWE-121, Stack-based Buffer Overflow, the same weakness class affecting the firewall rule handler disclosed alongside it. Overwriting stack memory in this way can corrupt adjacent data, including saved return addresses, giving a sufficiently skilled attacker the ability to hijack the program's execution flow.[nvd.nist]

Severity and Scoring

The vulnerability carries a serious severity rating, reflecting both remote exploitability and its potential for full device compromise.

The CVSS-BT score sits at 7.4, High, consistent with the companion vulnerability in the same disclosure batch, reflecting a network attack vector, low attack complexity, and significant impact potential. The vulnerability was published to NVD on May 30, 2026, and last modified on June 1, 2026, with a working exploit already published and available for use.[nvd.nist]

How an Attacker Exploits It

An attacker crafts an oversized value for the keyword_list or keyword parameter and submits it to the /goform/formSetUrlFilter endpoint on the target router. Because the router's firmware never checks the input length against the buffer's actual capacity, the excess data spills over into adjacent stack memory, corrupting control-flow structures in the process.[nvd.nist]

A carefully constructed payload can turn this memory corruption into arbitrary code execution on the device itself, since stack overflows of this type are a well-established path to full control when exploited skillfully. Since the attack can be carried out entirely over the network, any router with its management interface exposed, whether to the local network or, worse, the public internet, faces a realistic risk of remote compromise.

Why There Will Never Be a Patch

TRENDnet's official position, quoted directly in the vulnerability record, states that the product "has been EOL for 15 years (since 2009)" and that "we are not able to replicate or fix any vulnerabilities" affecting it. This is the identical vendor statement issued for the related CVE-2026–10120 flaw, confirming that TRENDnet treats the entire device line as permanently unsupported regardless of how many additional vulnerabilities researchers uncover in it.[nvd.nist]

The NVD record explicitly notes that this vulnerability only affects products no longer supported by the maintainer, effectively codifying that no future firmware update will ever address this defect. For any organization still running this hardware, the vulnerability's status is permanent rather than pending.[nvd.nist]

Detection and Warning Signs

Given the absence of a vendor fix, detecting exploitation attempts becomes the primary defensive lever available to affected users.

• HTTP POST requests to /goform/formSetUrlFilter containing unusually long values in the keyword_list or keyword fields
• Unexpected router reboots, crashes, or configuration changes with no corresponding administrative action
• Unusual outbound traffic patterns from the router itself, which could indicate a compromised device being used as a pivot point
• Unauthorized changes to URL filtering, firewall, or DNS settings not made by legitimate administrators

Remediation Guidance

With no prospect of an official patch, mitigation rests entirely on isolating or decommissioning the affected hardware.

• Treat any TRENDnet TEW-432BRP device discovered on your network as permanently vulnerable and prioritize its replacement.
• Disable remote or WAN-facing access to the router's web management interface immediately.
• Segment any legacy router still in service onto an isolated VLAN separate from primary network traffic.
• Replace the device with a currently supported model that receives active firmware security updates.
• Audit your network for other end-of-life hardware, since a device already carrying two related overflow vulnerabilities in one disclosure batch is likely to harbor further undiscovered issues.

Why This Matters

The near-identical nature of this flaw and CVE-2026–10120, both stack overflows in different /goform/ endpoints on the same unsupported device, suggests a systemic lack of input validation across the router's entire web management codebase rather than an isolated coding mistake. Organizations should recognize that finding one exploitable endpoint on end-of-life hardware like this is rarely an isolated incident, and should treat the discovery of any single flaw as a signal to retire the device entirely rather than patch around individual CVEs that will never receive a fix.