CVE-2026-129351

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-129351", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-14T06:31:24.764Z", "datePublished": "2026-11-14T22:30:23.821Z", "dateUpdated": "2026-11-14T22:30:23.821Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-14T22:30:23.821Z"}, "title": "TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "TRENDnet", "product": "TEW-657BRM", "versions": [{"version": "1.00.1", "status": "affected"}], "cpes": ["cpe:2.3:o:trendnet:tew-657brm_firmware:*:*:*:*:*:*:*:*"], "modules": ["mini_httpd"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor explains: \"\"I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know.\" This vulnerability only affects products that are no longer supported by the maintainer."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 10, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 10, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-11-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-14T07:36:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ruanyi (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/437397", "name": "VDB-437397 | TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/437397/cti", "name": "VDB-437397 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-129351", "name": "CVE-2026-129351 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1043518", "name": "Submit #1043518 | TRENDnet TEW-657BRM 1.00.1 Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-mini_httpd.md", "tags": ["exploit"]}], "tags": ["unsupported-when-assigned"], "x_generator": ["VulDB PVTS v202611"]}}}

{}

{}

{}

{}