CVE-2026-10062 is a high severity (CVSS 8.8) stack-based buffer overflow in the TRENDnet TEW-432BRP router, firmware 3.10B20, in the route settings form. The vendor says the router has been end of life since 2009 and will not be fixed. The remedy is to retire the device and keep its admin page off untrusted networks.
What's affected
The record names the TRENDnet TEW-432BRP wireless router, firmware 3.10B20, and the /goform/formSetRoute handler in its web interface. Other firmware revisions are not mentioned in the record.
There is no fixed version. The record quotes the vendor: the product has been end of life for 15 years, since 2009, and TRENDnet is "not able to replicate or fix any vulnerabilities". Plan around that, not around a patch.
How to check if you're exposed
There is no package manager here, so this is an inventory exercise.
- Search your asset list, purchase records and network scans for the model name TEW-432BRP.
- Check the label on the device or its admin page for the model and firmware revision. The record covers 3.10B20.
- Check whether the web admin interface is reachable from anywhere other than a trusted management network, in particular from the internet.
If you find one, assume it is exposed until you have shown otherwise.
What to do now
- Replace the router with a supported model. The vendor has said it will not fix this class of problem on an end of life product.
- Until it is gone, do not expose the web admin interface to the internet and limit it to one trusted management host.
- Change the administrator password and make sure it is not reused elsewhere, since exploitation needs a login (the vector lists low privileges).
- Put the device on its own network segment so a compromise cannot reach file servers or workstations.
- Record the device in your risk register with a retirement date.
Why it matters
The record ties the overflow to the ip, mask and gateway arguments of formSetRoute. It is classed as CWE-119 (operations outside the bounds of a memory buffer) and CWE-121 (the stack-based form of it).
With a low privilege login and a network path, the vector rates confidentiality, integrity and availability impact as high. A memory overflow in a router can mean a crash or something worse, though the record does not describe the consequences beyond the score.
The exploit is described as public. No exploitation in the wild is reported in the record, and the KEV flag is false.
Quick check
Why is this rated higher than the command injection on the same router?
The memory corruption vector scores high impact on confidentiality, integrity and availability, which gives 8.8. The injection flaws are scored 6.3 with lower impact values.
Sources
Last reviewed: 19 October 2026.
