{"id":"CVE-2026-129352","kind":"vulnerability","aliases":["CVE-2026-129352"],"related":[],"title":"TRENDnet TEW-657BRM router: remote stack overflow in firmware upgrade handler","description":"A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor explains: \"\"I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know.\"","summary":"The TRENDnet TEW-657BRM (firmware 1.00.1) upgrade_flash.cgi handler has a stack-based buffer overflow through the boundary argument. VulDB says it is remotely reachable but needs authentication, and that a proof-of-concept is public on GitHub. TRENDnet's 11/3/2026 notice lists a stack-based overflow for this firmware without a CVE id. The product is end-of-life and there is no fix.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TEW-657BRM","fixed":[],"affected":"firmware 1.00.1 (TRENDnet writes v1.0.0.1)","ecosystem":"vendor"}],"ecosystems":[],"tags":["eol-hardware","infrastructure","no-fix","routers","tew-657brm","trendnet"],"not_affected_if":["admin-not-exposed","device-retired","remote-management-disabled"],"how_to_check":"- Check whether the router is a TEW-657BRM (v1.xR) running firmware 1.00.1 (TRENDnet writes v1.0.0.1), from the label or the admin page.\n- Check whether the web admin interface is reachable from the internet (WAN remote management, port forwarding). TRENDnet says Remote Management should be off by default.\n- VulDB and the NVD CVSS vector say the attacker needs high privileges (a login), so check who can reach the admin page and whether its password is default or weak.","fix":"No fix: TRENDnet says the TEW-657BRM is end-of-life, it can no longer provide updates or technical assistance, and it recommends retiring the product. Replace the router.","status":"open","published_at":"2026-11-14T23:16:48+00:00","first_seen_at":"2026-11-14T23:32:09+00:00","triaged_at":"2026-11-14T23:32:41+00:00","updated_at":"2026-11-14T23:33:27+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-14T23:32:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TRENDnet TEW-657BRM router: remote stack overflow in firmware upgrade handler","impact":"high","summary":"The TRENDnet TEW-657BRM router's upgrade_flash.cgi firmware upload handler has a stack-based buffer overflow triggered by a manipulated boundary argument. A remote attacker can likely crash the device or run code on it, and a public exploit is reported.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["trendnet","tew-657brm","routers","eol-hardware"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"remote attacker runs code on the router","analyst_note":"Confirm whether the vendor issued any advisory or firmware for the EOL TEW-657BRM and whether the exploit is public at a specific URL; the vendor statement is unverified.","how_to_check":"- Check whether the router is a TEW-657BRM running firmware 1.00.1, printed on the label or shown in the admin page.\n- Check whether the device's web admin interface is reachable from the internet (port forwarding, exposed WAN admin).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["device-retired","admin-not-exposed"],"who_is_affected":"The product is end-of-life for more than 15 years and the vendor says it cannot confirm the flaw and will not necessarily patch it. Any TEW-657BRM still in service, especially one with the web admin reachable from the internet, should be replaced or isolated. Networks that no longer use this device can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4622,"output_tokens":599,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the vendor issued any advisory or firmware for the EOL TEW-657BRM and whether the exploit is public at a specific URL; the vendor statement is unverified.","search":"'-129352':15A,18A '-2026':14A,17A '/usr/sbin/upgrade_flash.cgi':122C '1.00.1':40B,112C '11/3/2026':76B '15':177C '657brm':4A,21A,32B,38B,111C 'abl':161C 'affect':115C 'announc':184C 'argument':53B,128C 'attack':138C 'authent':62B 'base':47B,82B,134C 'boundari':52B,129C 'buffer':48B,135C 'carri':143C 'concept':69B 'confirm':163C 'custom':186C 'cve':13A,16A,89B 'detect':106C 'end':95B 'end-of-lif':94B 'eol':23B,173C 'eol-hardwar':22B 'exist':167C 'explain':157C 'exploit':147C 'file':121C 'firmwar':10A,39B,86B 'fix':28B,102B 'github':73B 'handler':12A,42B 'hardwar':24B 'id':90B 'infrastructur':25B 'issu':114C 'know':187C 'let':185C 'life':97B 'list':78B 'manipul':125C 'may':152C 'need':61B 'no-fix':26B 'notic':77B 'overflow':8A,49B,83B,136C 'perform':123C 'possibl':140C 'process':118C 'product':92B,170C 'proof':67B 'proof-of-concept':66B 'public':71B,150C 'reachabl':59B 'remot':6A,58B,145C 'result':130C 'router':5A,29B 'say':55B 'send':181C 'stack':7A,46B,81B,133C 'stack-bas':45B,80B,132C 'tew':3A,20A,31B,37B,110C 'tew-657brm':2A,19A,30B,36B,109C 'trendnet':1A,33B,35B,74B,108C 'unknown':117C 'upgrad':11A 'upgrade_flash.cgi':41B 'use':154C 'vendor':156C 'vuldb':54B 'vulner':104C,166C 'without':87B 'year':178C","nicknames":[],"mitigations":[],"who_affected":"Only the TEW-657BRM (v1.xR) running firmware 1.00.1, a router TRENDnet ended support for in 2011. The flaw is in the firmware upload handler /usr/sbin/upgrade_flash.cgi (the boundary argument). VulDB says exploitation needs authentication. Any unit still in service is exposed, most of all one whose web admin is reachable from the internet. Teams with no such router can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-14T23:33:27Z","by":"analyst","doc":"https://www.trendnet.com/support/announcements.asp","run_id":4006}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["tew657brm"],"ptokens":["657brm","tew"],"labels":["critical","eolhardware","infrastructure","nofix","routers","tew657brm","trendnet"],"campaign_type":null,"search_a":"'-129352':15A,18A '-2026':14A,17A '657brm':4A,21A 'cve':13A,16A 'firmwar':10A 'handler':12A 'overflow':8A 'remot':6A 'router':5A 'stack':7A 'tew':3A,20A 'tew-657brm':2A,19A 'trendnet':1A 'upgrad':11A","search_b":"'1.00.1':40B '11/3/2026':76B '657brm':32B,38B 'argument':53B 'authent':62B 'base':47B,82B 'boundari':52B 'buffer':48B 'concept':69B 'cve':89B 'end':95B 'end-of-lif':94B 'eol':23B 'eol-hardwar':22B 'firmwar':39B,86B 'fix':28B,102B 'github':73B 'handler':42B 'hardwar':24B 'id':90B 'infrastructur':25B 'life':97B 'list':78B 'need':61B 'no-fix':26B 'notic':77B 'overflow':49B,83B 'product':92B 'proof':67B 'proof-of-concept':66B 'public':71B 'reachabl':59B 'remot':58B 'router':29B 'say':55B 'stack':46B,81B 'stack-bas':45B,80B 'tew':31B,37B 'tew-657brm':30B,36B 'trendnet':33B,35B,74B 'upgrade_flash.cgi':41B 'vuldb':54B 'without':87B","search_c":"'/usr/sbin/upgrade_flash.cgi':122C '1.00.1':112C '15':177C '657brm':111C 'abl':161C 'affect':115C 'announc':184C 'argument':128C 'attack':138C 'base':134C 'boundari':129C 'buffer':135C 'carri':143C 'confirm':163C 'custom':186C 'detect':106C 'eol':173C 'exist':167C 'explain':157C 'exploit':147C 'file':121C 'issu':114C 'know':187C 'let':185C 'manipul':125C 'may':152C 'overflow':136C 'perform':123C 'possibl':140C 'process':118C 'product':170C 'public':150C 'remot':145C 'result':130C 'send':181C 'stack':133C 'stack-bas':132C 'tew':110C 'tew-657brm':109C 'trendnet':108C 'unknown':117C 'use':154C 'vendor':156C 'vulner':104C,166C 'year':178C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T23:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129352","severity":null,"published_at":"2026-11-14T23:16:48+00:00","modified_at":"2026-11-14T23:16:48+00:00","first_seen_at":"2026-11-14T23:32:09+00:00","fetched_at":"2026-11-14T23:32:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129352:4006","url":"https://www.trendnet.com/support/announcements.asp","severity":null,"published_at":"2026-11-14T23:33:27+00:00","modified_at":"2026-11-14T23:33:27+00:00","first_seen_at":"2026-11-14T23:33:27+00:00","fetched_at":"2026-11-14T23:33:27+00:00","note":"VulDB VDB-437398 read: PoC public (GitHub link locked, not seen), auth needed, vendor could not confirm. TRENDnet 11/3/2026 notice for TEW-657BRM v1.0.0.1 says EOL, no updates, retire; it does not name this CVE. Not exploited per sources. Sibling CVE-2026-129351 is the same product.","cites":["https://www.trendnet.com/support/announcements.asp","https://vuldb.com/vuln/437398"]}],"documents":[{"id":159223,"url":"https://www.trendnet.com/support/announcements.asp","title":"TRENDnet announcements: Legacy Product TEW-657BRM (V1.xR) Possible Vulnerabilities, 11/3/2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":159224,"url":"https://vuldb.com/vuln/437398","title":"VulDB VDB-437398: TEW-657BRM 1.00.1 upgrade_flash.cgi boundary stack-based overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}