Cyber & AI intelligence
Briefs indexed3741
Issues36
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-129352 2026-11-14

CVE-2026-129352: Stack Overflow in End-of-Life TRENDnet TEW-657BRM Firmware

"A remotely reachable stack-based buffer overflow in TRENDnet TEW-657BRM firmware 1.00.1 has a public exploit, and the vendor says the product has been end-of-life for more than 15 years."

A remotely reachable stack-based buffer overflow in TRENDnet TEW-657BRM firmware 1.00.1 has a public exploit, and the vendor says the product has been end-of-life for more than 15 years.

What Is It

CVE-2026-129352 is a stack-based buffer overflow (CWE-121, CWE-119) in the TRENDnet TEW-657BRM. It sits in /usr/sbin/upgrade_flash.cgi. An attacker triggers it by manipulating the boundary argument, and the attack can be carried out remotely.

VulDB is the CNA. It scores the flaw 9.1 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and 8.5 HIGH under CVSS 4.0. The NVD record lists the CVE's status as "Deferred."

Why It Matters

According to the CVE description published in the NVD record, the exploit has been made public and may be used. The CVSS 4.0 vector also rates exploit maturity as Proof-of-Concept. The attack needs high privileges, but it has low complexity and needs no user interaction. Successful exploitation has high impact on confidentiality, integrity and availability, and the CVSS 3.1 scope is "Changed," so the damage can reach beyond the vulnerable component.

At the time of writing, no CISA KEV entry exists for this CVE. That means CISA has not confirmed active exploitation.

What's Vulnerable

Patch Status

No patch or fixed firmware version appears in the source data. TRENDnet's response, as quoted in the NVD record: "I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know."

There is no KEV entry, so there is no CISA-mandated required action or due date. TRENDnet has not said whether it will release a fix. Its statement promises only a customer announcement. Because the product is end-of-life and a public exploit exists, a firmware update looks unlikely. Organizations still running a TEW-657BRM should plan to replace the device, or isolate it from untrusted networks, rather than wait for a patch.

Sources