---
id: "CVE-2026-129351"
page: "https://infrastack.ai/live/CVE-2026-129351"
kind: "vulnerability"
aliases: ["CVE-2026-129351"]
title: "TRENDnet TEW-657BRM router: remote out-of-bounds write in setup.cgi"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TEW-657BRM", "fixed": [], "affected": "firmware 1.00.1 (hardware v1.0R)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "end-of-life", "infrastructure", "routers", "self-hosted", "trendnet"]
not_affected_if: ["admin-not-exposed", "other-models", "remote-management-disabled"]
published_at: "2026-11-14T23:16:47+00:00"
first_seen_at: "2026-11-14T23:32:09+00:00"
updated_at: "2026-11-14T23:33:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129351", "first_seen_at": "2026-11-14T23:32:09+00:00"}, {"source": "analyst", "url": "https://www.trendnet.com/support/view.asp?cat=4&id=116", "first_seen_at": "2026-11-14T23:33:54+00:00", "cites": ["https://www.trendnet.com/support/view.asp?cat=4&id=116", "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md", "https://nvd.nist.gov/vuln/detail/CVE-2026-129351"]}]
exploit_sources: []
---

# TRENDnet TEW-657BRM router: remote out-of-bounds write in setup.cgi

Link for people: https://infrastack.ai/live/CVE-2026-129351 (this .md is for agents)

TRENDnet TEW-657BRM firmware 1.00.1 has an out-of-bounds write reachable remotely over its web interface (NVD names setup.cgi in mini_httpd). A researcher's draft says it triggers before login; it was shown only in emulation. The product is end-of-life, TRENDnet cannot confirm the flaw, and no fix will be released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TEW-657BRM affected firmware 1.00.1 (hardware v1.0R) fixed no fixed version listed

## How to check

- Check the label or admin page: model TEW-657BRM, firmware 1.00.1 (TRENDnet's page writes v1.0.0.1). Any such device is in scope; no fixed version exists.
- Check whether the web admin (TCP/80) is reachable from the internet (Remote Management enabled, port forward) or by untrusted hosts on your LAN.
- Other TEW-657BRM revisions or firmware: no source covers them, treat as unknown.

## Fix

No fix: TRENDnet says the TEW-657BRM is end-of-life and end-of-support and it can no longer provide updates; it recommends retiring the device. Replace it with a supported router. Until then, per TRENDnet: disable Remote Management (should be off by default), close the config page after changing settings, use a strong admin password, restrict Wi-Fi to trusted people. These reduce risk; they are not a patch.

## Timeline

- 2026-11-14T23:32:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129351
- 2026-11-14T23:33:54+00:00 analyst https://www.trendnet.com/support/view.asp?cat=4&id=116 — NVD/VulDB: OOB write via sprintf, vendor cannot confirm, EOL. TRENDnet legacy page id=116 (11/3/2026) lists an out-of-bounds write for fw v1.0.0.1, no fix, mitigations listed. Researcher draft (GitHub) places the sink in mini_httpd pre-auth, tested only in QEMU, no physical confirmation; it says CVE not assigned, so link to this CVE unconfirmed; PoC not published there. No exploitation seen. Sibling CVE-2026-129352 in progress.

## Documents

- [advisory] TRENDnet: Legacy Product TEW-657BRM (V1.xR) Possible Vulnerabilities https://www.trendnet.com/support/view.asp?cat=4&id=116
- [describes] Researcher advisory: pre-auth buffer overflow in TEW-657BRM mini_httpd https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md
- [mentions] NVD CVE-2026-129351 https://nvd.nist.gov/vuln/detail/CVE-2026-129351

## From the sources

A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know." This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_