CVE-2026-129352

CVSS 9.1 (critical) · published 2026-11-14

A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor explains: ""I am not able to confirm if such vulnerability exists as the product has been EOL for more than 15 years. We will send out an announcement letting customers know."

Weakness: CWE-119, CWE-121

Source: NVD CVE-2026-129352

References

• https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-upgrade_flash.md
• https://vuldb.com/cve/CVE-2026-129352
• https://vuldb.com/submit/1043522
• https://vuldb.com/vuln/437398
• https://vuldb.com/vuln/437398/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.