CVE-2026-109157

Summary

A stack-based buffer overflow in TRENDnet routers allows remote code execution when manipulating the 'Name' parameter in the formTcpipSetup function. This critical vulnerability affects unsupported devices from 2011 and can be exploited without user interaction.

Exploitability

Exploitation is relatively straightforward with remote access to the vulnerable router's web interface, requiring only a single HTTP request to trigger the buffer overflow.

Blast radius

The vulnerability could affect thousands of legacy TRENDnet routers still in use, potentially allowing attackers to gain full control of network infrastructure and pivot to internal networks.

Detection

Monitor for unusual HTTP POST requests to /goform/formTcpipSetup with malformed Name parameters, particularly those exceeding 256 bytes, and watch for repeated failed authentication attempts or unexpected router reboots.

Prioritized remediation

Upgrade to firmware version 3.10B21 or later, as this is the first fixed version mentioned in the vendor's advisory for the affected TRENDnet TEW-432BRP model.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.