CVE-2026-10063 is a high severity (CVSS 8.8) stack-based buffer overflow in the WPS form of the TRENDnet TEW-432BRP router, firmware 3.10B20. TRENDnet says the product is end of life, dating from 2009, and cannot be fixed. Retire the device and keep its admin interface away from untrusted networks.
What's affected
The record names the TRENDnet TEW-432BRP wireless router, firmware 3.10B20, and the /goform/formWPS handler in its web interface. Other firmware revisions are not mentioned in the record.
There is no fixed version. The record quotes the vendor: the product has been end of life for 15 years, since 2009, and TRENDnet is "not able to replicate or fix any vulnerabilities". Plan around that, not around a patch.
How to check if you're exposed
There is no package manager here, so this is an inventory exercise.
- Search your asset list, purchase records and network scans for the model name TEW-432BRP.
- Check the label on the device or its admin page for the model and firmware revision. The record covers 3.10B20.
- Check whether the web admin interface is reachable from anywhere other than a trusted management network, in particular from the internet.
If you find one, assume it is exposed until you have shown otherwise.
What to do now
- Replace the router with a supported model. The vendor has said it will not fix this class of problem on an end of life product.
- Until it is gone, do not expose the web admin interface to the internet and limit it to one trusted management host.
- Change the administrator password and make sure it is not reused elsewhere, since exploitation needs a login (the vector lists low privileges).
- Put the device on its own network segment so a compromise cannot reach file servers or workstations.
- Record the device in your risk register with a retirement date.
Why it matters
The peerPin argument of formWPS is the input the record points to. The weakness is CWE-119 with its stack-based variant CWE-121: data written past the end of a buffer on the stack.
The attack is network based and needs a low privilege account. High impact scores on all three security properties explain the 8.8.
The record says the exploit is publicly available. It does not claim real world attacks and the CISA KEV flag is false.
Quick check
Do I need to worry if the admin page is only on my LAN?
Your exposure is lower, but anything on the LAN with a login could try. Segment the device and replace it. If it is reachable from the internet, treat it as urgent.
Sources
Last reviewed: 19 October 2026.
