Loading story…
Two high-severity vulnerabilities, CVE-2026-5349 and CVE-2026-5350, were disclosed in the discontinued Trendnet TEW-657BRM router firmware 1.00.1, exposing the device to remote stack-based buffer overflow attacks through /setup.cgi. The flaws affect the add_apcdb and update_pcdb functions respectively, where crafted input to the mac_pc_dba argument can trigger memory corruption. Both issues are classified under CWE-119 and CWE-121, with reported impact spanning confidentiality, integrity, and availability.
Public exploit information is available for both vulnerabilities, increasing the risk to any TEW-657BRM devices still deployed despite the product having reached end-of-life years ago. Trendnet said the router has been unsupported since 2011 and that it cannot confirm the vulnerabilities, but indicated it plans to publish a notice and notify registered customers. Organizations still operating the model face exposure without a supported vendor remediation path.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On April 2, 2026, CVE-2026-5349 and CVE-2026-5350 were recorded for remotely exploitable stack-based buffer overflows in Trendnet TEW-657BRM firmware 1.00.1, affecting the add_apcdb and update_pcdb functions in /setup.cgi via the mac_pc_dba argument. The disclosures noted public exploit information was available and that Trendnet planned to post a notice and notify registered customers, while saying it could not confirm the vulnerabilities because the product was discontinued.
Trendnet stated the TEW-657BRM had been end-of-life since June 23, 2011 and was no longer supported. This later affected the vendor's ability to validate or remediate newly reported flaws in the device.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 1.0.0.9** and **F453 1.0.0.3**. The flaws are tracked as `CVE-2026-4534` and `CVE-2026-4552` and both involve remotely reachable stack-based buffer overflows in web management handlers. In the FH451 case, the issue is in the `formWrlExtraSet` function exposed through the `/goform/WrlExtraSet` component, where manipulation of the `GO` argument can trigger memory corruption. In the F453 case, the vulnerable code is the `fromVirtualSer` function behind the `/goform/VirtualSer` endpoint, where the `page` argument can be abused to cause a similar overflow. Both CVE records indicate that **public exploits are available**, increasing the likelihood of opportunistic attacks against exposed devices. The disclosures map the weaknesses to `CWE-119` and `CWE-121`, reflecting out-of-bounds memory handling and stack-based buffer overflow conditions, and the published scoring points to high impact on confidentiality, integrity, and availability. Organizations using these Tenda models should treat the flaws as urgent remote compromise risks, especially where router administration interfaces are internet-accessible.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **Tenda AC5** version `15.03.06.47` and **Tenda AC6** version `15.03.05.16`. The flaws reside in the `formQuickIndex` function behind the `/goform/QuickIndex` POST request handler, where improper handling of the `PPPOEPassword` parameter can trigger a **stack-based buffer overflow**. Both issues are tracked as `CVE-2026-4903` for AC5 and `CVE-2026-4961` for AC6. The vulnerabilities are described as **remotely exploitable**, with **public exploits available**, raising the risk of real-world attacks against exposed devices. The entries map the weaknesses to `CWE-119` and `CWE-121`, and their published CVSS vectors indicate high impact across **confidentiality, integrity, and availability**, making these flaws significant for organizations or users still operating the affected firmware.
Jun 29, 2026
Two router vulnerabilities have been disclosed that expose **D-Link DIR-513** and **Tenda A18 Pro** devices to remotely triggered stack-based buffer overflows. **CVE-2026-4486** affects D-Link DIR-513 version `1.10` in the web service function `formEasySetPassword` at the `/goform/formEasySetPassword` endpoint, where a crafted `curTime` argument can trigger memory corruption. The issue is classified under `CWE-119` and `CWE-121`, and the affected D-Link product is no longer supported by the vendor. A separate flaw, **CVE-2026-4491**, impacts **Tenda A18 Pro** firmware `02.03.02.28` in the `fromSetIpMacBind` function exposed through `/goform/SetIpMacBind`. The vulnerability can be exploited remotely with low attack complexity and low privileges by manipulating request arguments, resulting in a stack-based overflow. Both CVEs were reported as **publicly exploitable**, with references indicating proof-of-concept or exploit details are already available, increasing the risk to internet-exposed and unpatched devices.
Jun 29, 2026