Description
A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know."
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TRENDnet | TEW-657BRM | 1.00.1 | — |
References
- VDB-437398 | TRENDnet TEW-657BRM upgrade_flash.cgi stack-based overflow vdb-entry technical-description
- VDB-437398 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-129352 | CVE Analysis and Report third-party-advisory
- Submit #1043522 | TRENDnet TEW-657BRM 1.00.1 Stack-based Buffer Overflow third-party-advisory
- https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-upgrade_flash.md exploit patch