CVE-2026-109157 is a remotely triggerable stack-based buffer overflow in the TRENDnet TEW-432BRP router, which reached end of life in 2011. A public exploit exists, and the vendor will not release a patch.
What Is It
The flaw is in the formTcpipSetup function of the /goform/formTcpipSetup endpoint on TRENDnet TEW-432BRP firmware 3.10B20. Changing the Name argument causes a stack-based buffer overflow (CWE-121, CWE-119). VulDB is the CVE Numbering Authority (CNA) and published the record on 2026-10-13. The NVD entry lists its status as "Deferred" and tags it "unsupported-when-assigned."
Why It Matters
- Severity: VulDB scores it CVSS 3.1 9.9 (Critical), vector
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The CVSS 4.0 score is 8.6 (High), and the CVSS 2.0 score is 9.0. - Attack conditions: The attack works over the network with low complexity. It needs low-level privileges and no user interaction.
- Impact: Confidentiality, integrity and availability impacts are all rated High. CVSS 3.1 also marks the scope as Changed.
- Exploit availability: The CVE description, as published by VulDB and shown on NVD, says "the exploit has been made public and could be used." The CVSS 4.0 exploit maturity is Proof-of-Concept.
- KEV status: As of 2026-10-13, this CVE is not in the CISA Known Exploited Vulnerabilities catalog, so CISA has not confirmed active exploitation.
What's Vulnerable
- Vendor: TRENDnet
- Product: TEW-432BRP
- Affected version: firmware 3.10B20
- CPE:
cpe:2.3:o:trendnet:tew-432brp_firmware:*:*:*:*:*:*:*:*
The record says the vulnerability "only affects products that are no longer supported by the maintainer."
Patch Status
There is no patch, and none is expected. TRENDnet's statement in the record reads: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." The vendor has not confirmed the flaw and has not offered a fix.
Because the CVE is not in the KEV catalog, there is no federal remediation deadline or required action. Any TEW-432BRP still in service should be treated as permanently unpatched: a public exploit exists and no vendor fix is coming.