CVE-2026-10159: TRENDnet TEW-432BRP Stack-Based Buffer Overflow

The National Vulnerability Database has detailed CVE-2026-10159, a high-severity stack-based buffer overflow affecting TRENDnet TEW-432BRP devices. Specifically, the vulnerability resides in the formSysLog function within the /goform/formSysLog file. Manipulating the current_page argument can trigger the overflow, enabling remote attackers to exploit the flaw. An exploit for this vulnerability is publicly available.

TRENDnet confirmed the product, TEW-432BRP, reached End-of-Life (EOL) in 2009, making it unsupported for 15 years. Consequently, the vendor states they cannot replicate or patch the vulnerability. This means any devices still in operation are permanently exposed, underscoring the critical risks associated with maintaining EOL hardware in production environments. The CVSSv3.1 score of 8.8 (High) confirms the severity, highlighting potential for complete compromise.

For defenders, this is a stark reminder about asset inventory and lifecycle management. While the vendor is absolved, the risk transfers entirely to the asset owner. Attackers continually weaponize vulnerabilities in unsupported hardware because they know these devices often remain unpatched and forgotten, offering a persistent backdoor into networks. This isn’t just about TRENDnet; it’s a systemic problem in IT and OT environments with long-lived, unmonitored devices.