External risk intelligence

TRENDnet TEW-657BRM Remote Out-of-Bounds Write in mini_httpd.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-129351

The vulnerability exists in the mini_httpd component of a home/SOHO router within the setup.cgi interface. Such management interfaces on network edge devices are designed to be reachable over the network and, in many deployment scenarios, are exposed directly to the internet or reachable through the WAN interface by design.

Memory Corruption

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been publicly disclosed that affects TRENDnet network devices. This issue, related to how a specific program handles data, could allow remote attackers to execute commands. While the vendor states the affected product is no longer supported, confirmation of relevance and exposure is the main concern.

Out-of-bounds write in device's web interface.
Publicly disclosed vulnerability, potentially exploitable.
Confirm relevance and exposure for unsupported products.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by sending a crafted request to the affected device's web interface. This targets a weakness in how the mini_httpd component handles data within the setup.cgi file, potentially allowing an attacker to write data outside of allocated memory. The vendor has stated they cannot confirm the vulnerability due to the product being end-of-life for over 15 years.

Network access required.
Vulnerable function in setup.cgi.
Out-of-bounds write risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to cause an out-of-bounds write when the `sprintf` function in the router's web interface is manipulated. This could potentially impact the system's stability and behavior when accessed remotely and without authentication, especially on devices no longer supported by the vendor.

System stability and service behavior.
Remote, unauthenticated network access.
Potential denial of service or instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that the affected product has been End-of-Life for over 15 years, the primary responsibility for addressing this vulnerability likely falls to the asset owner or IT infrastructure team responsible for managing legacy systems. The first practical move is to identify all instances of this specific router model within the environment. Once located, confirm its network exposure and business criticality to prioritize any necessary actions, which may involve vendor coordination if any support channels remain, or risk mitigation if the device cannot be decommissioned.

Identify accountable asset owners.
Verify device network exposure.
Plan for decommissioning or risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TRENDnet TEW-657BRM?

The TRENDnet TEW-657BRM is a legacy home and small office router designed to manage network traffic. It acts as a gateway for internet connectivity, providing essential routing functions and a web-based interface for configuration. Because this hardware reached its end-of-life over 15 years ago, it lacks modern security protections and no longer receives software or security updates from the manufacturer.

What does CVE-2026-129351 mean for the router?

This vulnerability is an out-of-bounds write, categorized as CWE-119 and CWE-787. It occurs in the device's mini_httpd component, which powers its web-based management interface. When the software attempts to process data using the sprintf function, it fails to verify memory boundaries correctly. This can allow an attacker to overwrite system memory, potentially causing the router to crash or behave in unintended ways.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the setup.cgi file on the device's web interface. This does not require any prior authentication or local access to the machine. The vulnerability is tied specifically to the handling of inputs within the web management interface; normal network traffic passing through the router to other devices does not trigger this memory corruption issue.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is highly relevant because it resides in a management interface typically designed for network access. If your router's management page is reachable over the internet or through your WAN interface, it is at higher risk. Devices exposed directly to the internet are immediate targets, whereas those restricted to internal, private management networks face a smaller, though still present, attack surface.

What should I do if I have this hardware?

The most effective response is to identify and retire the device, as it is no longer supported by the vendor. Start by locating all instances in your environment and auditing their network accessibility. If you cannot decommission the device immediately, prioritize moving it to a strictly isolated network segment that is not reachable from the internet or untrusted internal zones to mitigate the risk of remote exploitation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.