TRENDnet TEW-432BRP Vulnerability: EOL Device Stack Buffer Overflow

title: CVE-2026-10179 - TRENDnet TEW-432BRP formSetWlanEncrypt Stack Buffer Overflow
id: scw-2026-05-31-ai-1
status: experimental
level: critical
description: |
  This rule detects attempts to exploit CVE-2026-10179 by targeting the vulnerable formSetWlanEncrypt function in TRENDnet TEW-432BRP devices. The exploit involves sending a POST request to '/goform/formSetWlanEncrypt' with specific parameters that trigger a stack-based buffer overflow. The presence of common Wi-Fi encryption key parameters in the query string, combined with the specific URI and POST method, strongly indicates an attempt to exploit this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-31
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-10179/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/goform/formSetWlanEncrypt'
      cs-uri-query|contains:
          - 'WEPKey=' 
          - 'ssid=' 
          - 'wlanKey=' 
          - 'key=' 
          - 'pass=' 
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse