Quick answers
- Is CVE-2026-109157 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109157 being exploited in the wild.
- How severe is CVE-2026-109157?
- Critical severity, with a CVSS score of 9.9, published 13 October 2026.
- Which products and versions are affected?
- TRENDnet TEW-432BRP 3.10B20.
- Is there a fix for CVE-2026-109157?
- No fixed version is recorded yet. Discontinue use of this router as it is no longer supported and no patches will be provided by the vendor. Replace with a current-generation router that receives security updates. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-109157 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-109157?
- Check whether you run TRENDnet TEW-432BRP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Discontinue use of this router as it is no longer supported and no patches will be provided by the vendor. Replace with a current-generation router that receives security updates.
Technical details
The formTcpipSetup function in the router's web interface directly copies user-supplied input from the "name" parameter into a fixed-size stack buffer without bounds checking, causing a stack-based buffer overflow. An unauthenticated remote attacker can exploit this via a crafted POST request to /goform/formTcpipSetup to crash the router or achieve code execution. No patch is available as the product reached end-of-life in 2011.
Affected products
- TRENDnet TEW-432BRP 3.10B20
Timeline
- 2026-10-13: disclosed
- other: Product reached end-of-life in 2011; vendor confirms no testing possible and no fix will be issued