A stack-based buffer overflow vulnerability in the TRENDnet TEW-632BRP router allows an authenticated attacker to trigger memory corruption and potential system compromise.

The vulnerability exists in the HTTP POST request handler of the ping_response.cgi file, where the ping_ipaddr parameter is processed using an unsafe strcpy function. This flaw requires the attacker to have administrative privileges to reach the vulnerable function and successfully trigger the overflow.

Successful exploitation of this vulnerability could lead to a complete denial of service or the execution of arbitrary code with high privileges on the affected network device. Given the CVSS score of 7.2, this represents a significant risk to network integrity, as compromised routers can be used as pivot points for lateral movement or to intercept sensitive traffic within the organization.

Immediate Action: Since no vendor patch is currently available, immediately restrict access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous POST requests to ping_response.cgi, particularly those containing unusually long ping_ipaddr strings.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to inspect and drop malformed HTTP requests directed at the router management interface.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's technical write-up on GitHub.

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, users must treat this device as high risk. Organizations should prioritize isolating the management interface from the internal network and plan for the eventual decommissioning or replacement of this hardware if the vendor fails to provide a firmware update.