{"id":"CVE-2026-129351","kind":"vulnerability","aliases":["CVE-2026-129351"],"related":[],"title":"TRENDnet TEW-657BRM router: remote out-of-bounds write in setup.cgi","description":"A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: \"\"I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know.\" This vulnerability only affects products that are no longer supported by the maintainer.","summary":"TRENDnet TEW-657BRM firmware 1.00.1 has an out-of-bounds write reachable remotely over its web interface (NVD names setup.cgi in mini_httpd). A researcher's draft says it triggers before login; it was shown only in emulation. The product is end-of-life, TRENDnet cannot confirm the flaw, and no fix will be released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TEW-657BRM","fixed":[],"affected":"firmware 1.00.1 (hardware v1.0R)","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","end-of-life","infrastructure","routers","self-hosted","trendnet"],"not_affected_if":["admin-not-exposed","other-models","remote-management-disabled"],"how_to_check":"- Check the label or admin page: model TEW-657BRM, firmware 1.00.1 (TRENDnet's page writes v1.0.0.1). Any such device is in scope; no fixed version exists.\n- Check whether the web admin (TCP/80) is reachable from the internet (Remote Management enabled, port forward) or by untrusted hosts on your LAN.\n- Other TEW-657BRM revisions or firmware: no source covers them, treat as unknown.","fix":"No fix: TRENDnet says the TEW-657BRM is end-of-life and end-of-support and it can no longer provide updates; it recommends retiring the device. Replace it with a supported router. Until then, per TRENDnet: disable Remote Management (should be off by default), close the config page after changing settings, use a strong admin password, restrict Wi-Fi to trusted people. These reduce risk; they are not a patch.","status":"open","published_at":"2026-11-14T23:16:47+00:00","first_seen_at":"2026-11-14T23:32:09+00:00","triaged_at":"2026-11-14T23:32:41+00:00","updated_at":"2026-11-14T23:33:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-14T23:32:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TRENDnet TEW-657BRM router: remote out-of-bounds write in setup.cgi","impact":"high","summary":"The TRENDnet TEW-657BRM 1.00.1 router has an out-of-bounds write in the /setup.cgi handler of its mini_httpd web server, reachable remotely. An attacker who can reach the router's web interface can likely crash it or run code on it, and the exploit is public.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["trendnet","routers","self-hosted","embedded"],"confidence":0.5,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs code on the router or crashes it remotely","analyst_note":"Vendor is unable to confirm and no fix exists; check NVD and the exploit disclosure for the exact trigger and whether authentication is needed.","how_to_check":"- Look up the model and firmware version printed on the router's label or in its admin page; this device is `TEW-657BRM` on firmware `1.00.1`\n- Check whether the router's web admin interface is reachable from the internet (port forwarding, exposed WAN management)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-models","admin-not-exposed"],"who_is_affected":"The flaw is in the router's built-in web server, so any TEW-657BRM on firmware 1.00.1 with its admin interface reachable from the network is in scope. The vendor says the product has been end-of-life for more than 15 years and it will not confirm the flaw, so no patch is expected; the only safe path is replacing the device. Networks where the router's admin interface is not reachable from outside are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4642,"output_tokens":650,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Vendor is unable to confirm and no fix exists; check NVD and the exploit disclosure for the exact trigger and whether authentication is needed.","search":"'-129351':16A,19A '-2026':15A,18A '/setup.cgi':113C '1.00.1':39B,103C '15':166C '657brm':4A,22A,37B,102C 'abl':150C 'affect':106C,180C 'announc':173C 'attack':129C 'bound':10A,45B,126C 'cannot':82B 'compon':116C 'confirm':83B,152C 'custom':175C 'cve':14A,17A 'detect':97C 'disclos':138C 'draft':62B 'embed':23B 'emul':73B 'end':25B,78B 'end-of-lif':24B,77B 'eol':162C 'execut':132C 'exist':156C 'explain':146C 'exploit':135C 'file':112C 'firmwar':38B 'fix':88B 'flaw':85B 'function':108C 'host':32B 'httpd':58B,118C 'infrastructur':28B 'interfac':52B 'know':176C 'lead':121C 'let':174C 'life':27B,80B 'login':67B 'longer':185C 'maintain':189C 'manipul':120C 'may':141C 'mini':57B,117C 'name':54B 'nvd':53B 'out-of-bound':7A,42B,123C 'product':75B,159C,181C 'public':139C 'reachabl':47B 'releas':91B 'remot':6A,48B,133C 'research':60B 'router':5A,29B 'say':63B 'secur':93C 'self':31B 'self-host':30B 'send':170C 'setup.cgi':13A,55B 'shown':70B 'sprintf':109C 'support':186C 'tew':3A,21A,36B,101C 'tew-657brm':2A,20A,35B,100C 'trendnet':1A,33B,34B,81B,99C 'trigger':65B 'use':143C 'vendor':145C 'vulner':94C,105C,155C,178C 'web':51B 'write':11A,46B,127C 'year':167C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the router's built-in web server, so any TEW-657BRM on firmware 1.00.1 with its admin interface reachable from the network is in scope. The vendor says the product has been end-of-life for more than 15 years and it will not confirm the flaw, so no patch is expected; the only safe path is replacing the device. Networks where the router's admin interface is not reachable from outside are at lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-14T23:33:54Z","by":"analyst","doc":"https://www.trendnet.com/support/view.asp?cat=4&id=116","run_id":4007}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["tew657brm"],"ptokens":["657brm","tew"],"labels":["critical","embedded","endoflife","infrastructure","routers","selfhosted","trendnet"],"campaign_type":null,"search_a":"'-129351':16A,19A '-2026':15A,18A '657brm':4A,22A 'bound':10A 'cve':14A,17A 'out-of-bound':7A 'remot':6A 'router':5A 'setup.cgi':13A 'tew':3A,21A 'tew-657brm':2A,20A 'trendnet':1A 'write':11A","search_b":"'1.00.1':39B '657brm':37B 'bound':45B 'cannot':82B 'confirm':83B 'draft':62B 'embed':23B 'emul':73B 'end':25B,78B 'end-of-lif':24B,77B 'firmwar':38B 'fix':88B 'flaw':85B 'host':32B 'httpd':58B 'infrastructur':28B 'interfac':52B 'life':27B,80B 'login':67B 'mini':57B 'name':54B 'nvd':53B 'out-of-bound':42B 'product':75B 'reachabl':47B 'releas':91B 'remot':48B 'research':60B 'router':29B 'say':63B 'self':31B 'self-host':30B 'setup.cgi':55B 'shown':70B 'tew':36B 'tew-657brm':35B 'trendnet':33B,34B,81B 'trigger':65B 'web':51B 'write':46B","search_c":"'/setup.cgi':113C '1.00.1':103C '15':166C '657brm':102C 'abl':150C 'affect':106C,180C 'announc':173C 'attack':129C 'bound':126C 'compon':116C 'confirm':152C 'custom':175C 'detect':97C 'disclos':138C 'eol':162C 'execut':132C 'exist':156C 'explain':146C 'exploit':135C 'file':112C 'function':108C 'httpd':118C 'know':176C 'lead':121C 'let':174C 'longer':185C 'maintain':189C 'manipul':120C 'may':141C 'mini':117C 'out-of-bound':123C 'product':159C,181C 'public':139C 'remot':133C 'secur':93C 'send':170C 'sprintf':109C 'support':186C 'tew':101C 'tew-657brm':100C 'trendnet':99C 'use':143C 'vendor':145C 'vulner':94C,105C,155C,178C 'write':127C 'year':167C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T23:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129351","severity":null,"published_at":"2026-11-14T23:16:47+00:00","modified_at":"2026-11-14T23:16:47+00:00","first_seen_at":"2026-11-14T23:32:09+00:00","fetched_at":"2026-11-14T23:32:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129351:4007","url":"https://www.trendnet.com/support/view.asp?cat=4&id=116","severity":null,"published_at":"2026-11-14T23:33:54+00:00","modified_at":"2026-11-14T23:33:54+00:00","first_seen_at":"2026-11-14T23:33:54+00:00","fetched_at":"2026-11-14T23:33:54+00:00","note":"NVD/VulDB: OOB write via sprintf, vendor cannot confirm, EOL. TRENDnet legacy page id=116 (11/3/2026) lists an out-of-bounds write for fw v1.0.0.1, no fix, mitigations listed. Researcher draft (GitHub) places the sink in mini_httpd pre-auth, tested only in QEMU, no physical confirmation; it says CVE not assigned, so link to this CVE unconfirmed; PoC not published there. No exploitation seen. Sibling CVE-2026-129352 in progress.","cites":["https://www.trendnet.com/support/view.asp?cat=4&id=116","https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md","https://nvd.nist.gov/vuln/detail/CVE-2026-129351"]}],"documents":[{"id":159225,"url":"https://www.trendnet.com/support/view.asp?cat=4&id=116","title":"TRENDnet: Legacy Product TEW-657BRM (V1.xR) Possible Vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":159226,"url":"https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md","title":"Researcher advisory: pre-auth buffer overflow in TEW-657BRM mini_httpd","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":159227,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129351","title":"NVD CVE-2026-129351","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}