CVE-2026-10064 is a medium (CVSS 6.3) stack-based buffer overflow in the port trigger form of the TRENDnet TEW-432BRP router, firmware 3.10B20. The vendor says this end of life product will not be fixed. Replace the device, and until then keep its admin page off untrusted networks.
What's affected
The record names the TRENDnet TEW-432BRP wireless router, firmware 3.10B20, and the /goform/formSetPortTr handler in its web interface. Other firmware revisions are not mentioned in the record.
There is no fixed version. The record quotes the vendor: the product has been end of life for 15 years, since 2009, and TRENDnet is "not able to replicate or fix any vulnerabilities". Plan around that, not around a patch.
How to check if you're exposed
There is no package manager here, so this is an inventory exercise.
- Search your asset list, purchase records and network scans for the model name TEW-432BRP.
- Check the label on the device or its admin page for the model and firmware revision. The record covers 3.10B20.
- Check whether the web admin interface is reachable from anywhere other than a trusted management network, in particular from the internet.
If you find one, assume it is exposed until you have shown otherwise.
What to do now
- Replace the router with a supported model. The vendor has said it will not fix this class of problem on an end of life product.
- Until it is gone, do not expose the web admin interface to the internet and limit it to one trusted management host.
- Change the administrator password and make sure it is not reused elsewhere, since exploitation needs a login (the vector lists low privileges).
- Put the device on its own network segment so a compromise cannot reach file servers or workstations.
- Record the device in your risk register with a retirement date.
Why it matters
This one sits in formSetPortTr, and the special_name argument is the input named in the record. The classes are CWE-119 and CWE-121.
Its score of 6.3 is lower than the other overflows because the vector rates the impact as low on each property. That does not make it safe to leave in place. A router sits on the edge of your network and sees traffic for everything behind it.
The record says the exploit has been released. It does not report exploitation in the wild, and the KEV flag is false.
Quick check
Is there any CVE-level fix for this router?
No. The vendor statement in the record says it cannot replicate or fix vulnerabilities on this product. The only durable fix is to replace the hardware.
Sources
Last reviewed: 19 October 2026.
