TRENDnet TEW-635BRM stack-based Buffer Overflow

Overview

CVE-2026-15480 describes a classic stack-based buffer overflow residing in the start_httpd function within /sbin/rc on TRENDnet’s TEW-635BRM ADSL2+ modem-router, affecting all firmware versions through 1.00.03. The vulnerable code path processes a user-supplied device_name parameter without adequate length validation before copying it into a fixed-size stack buffer. Because the web service component exposes this code path to the network, a remote attacker can trigger the overflow without requiring physical access to the device.

The vulnerability was documented by independent security researchers who published a full proof-of-concept. TRENDnet acknowledged the report but declined to issue a patch, citing end-of-life (EOL) status since 2011. This puts any remaining deployment of the TEW-635BRM — and there are still thousands of these devices reachable on the public internet — in a permanently unpatched state with a publicly available exploit.

The CVSS v3 score of 8.8 (High) reflects the fact that no authentication is required to reach the vulnerable parameter, the attack vector is network-accessible, and successful exploitation grants full control of the underlying embedded Linux environment.

Technical Analysis

The root cause is a textbook unsafe string copy into a statically-sized stack buffer. Embedded firmware for MIPS-based home routers of this era almost universally used strcpy or sprintf without length checks when populating configuration variables. In start_httpd, the device_name value is read from an HTTP request parameter or a configuration store and then passed directly into a strcpy call targeting a local character array.

A representative reconstruction of the vulnerable pattern looks like this:

/* /sbin/rc — start_httpd() — firmware <= 1.00.03 */
#define DEVICE_NAME_MAX 64

void start_httpd(void) {
    char device_name[DEVICE_NAME_MAX];  /* fixed 64-byte stack buffer */
    char *param;

    /* Retrieve user-controlled input from the HTTP environment */
    param = getenv("QUERY_STRING");     /* or parsed from CGI POST body */

    /* !! No length check before copy — classic CWE-121 !! */
    strcpy(device_name, param);         /* overflows if param > 63 bytes */

    /* device_name is later used to configure the httpd process name */
    setenv("DEVICE_NAME", device_name, 1);
    execl("/usr/sbin/httpd", device_name, NULL);
}

On a MIPS32 little-endian target (the processor family used in this router generation), the saved return address sits immediately above local variables on the stack. Supplying a device_name value longer than 64 bytes overwrites the saved $ra register. Because MIPS routers of this vintage typically lack Address Space Layout Randomization (ASLR), stack canaries, or NX/XN bits enforced by the operating system, an attacker can:

1. Pad the overflow payload to the exact offset between the start of device_name and the saved return address.
2. Overwrite $ra with the address of a ROP gadget or directly with a shellcode landing address on the stack.
3. Return from start_httpd, transferring control to attacker-supplied code.

The exploit published alongside this CVE demonstrates this exact technique, providing a working payload that spawns a bind shell on the device. The offset calculation is deterministic because the firmware is not position-independent and loads at fixed virtual addresses — making MIPS ROP chains highly portable across individual units running the same firmware version.

The CGI or httpd front-end forwards query parameters to /sbin/rc before any authentication check occurs, which is why no credentials are needed to reach the sink.

Impact

A remote, unauthenticated attacker who can reach the router’s web management port (typically TCP 80 or 8080) can exploit this vulnerability to achieve arbitrary code execution as root. On embedded Linux devices, there is no privilege separation — the web daemon runs as root, so code execution is immediately at the highest privilege level.

Concrete attacker outcomes include:

• Persistent backdoor installation: Overwriting /etc/init.d scripts or cron entries in NVRAM to survive reboots.
• Network pivoting: The device sits on the LAN/WAN boundary; an attacker who owns it can intercept, modify, or redirect all traffic passing through it — including DNS responses, HTTP sessions, and VoIP streams.
• Botnet recruitment: IoT buffer overflow exploits are a primary recruitment vector for botnets. A device with a public exploit and no patch path is trivial to weaponize at scale.
• Credential harvesting: The router manages PPPoE credentials, Wi-Fi PSKs, and admin passwords stored in NVRAM, all of which become accessible post-exploitation.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accurately encodes the severity: network-accessible, low complexity, no privileges required, no user interaction.

How to Fix It

For end users: TRENDnet will not release a patch. The only definitive remediation is device replacement with supported hardware. In the interim:

1. Disable remote management — ensure the router’s web interface is not accessible from the WAN interface.
2. Apply firewall ACLs — use an upstream firewall or ISP-level filtering to block inbound connections to port 80/8080 destined for the router’s management IP.
3. Segment the device — if the device cannot be replaced immediately, isolate it on a dedicated VLAN with restrictive inter-VLAN routing rules.

For firmware developers encountering this pattern in active codebases, the fix requires two coordinated changes:

/* FIXED version — bounds-checked copy */
#define DEVICE_NAME_MAX 64

void start_httpd(void) {
    char device_name[DEVICE_NAME_MAX];
    char *param;

    param = getenv("QUERY_STRING");
    if (param == NULL) {
        return;  /* handle missing parameter gracefully */
    }

    /* Use strncpy and explicitly null-terminate */
    strncpy(device_name, param, sizeof(device_name) - 1);
    device_name[sizeof(device_name) - 1] = '\0';

    /* Alternatively, use snprintf which handles truncation cleanly */
    /* snprintf(device_name, sizeof(device_name), "%s", param); */

    setenv("DEVICE_NAME", device_name, 1);
    execl("/usr/sbin/httpd", device_name, NULL);
}

Additionally, modern toolchain mitigations should be enabled at build time for any embedded firmware project:

• Compile with -fstack-protector-strong to insert stack canaries.
• Link with -Wl,-z,relro,-z,now and enable PIE (-fPIE -pie) where the target architecture supports it.
• Enable ASLR in the kernel configuration (CONFIG_RANDOMIZE_BASE).

Our Take

This vulnerability is a microcosm of the broader IoT security crisis. Stack-based buffer overflows via strcpy have been a known-dangerous pattern since the late 1990s, yet they persist in embedded firmware because IoT development pipelines historically operated outside the security engineering practices applied to enterprise software. No SAST gate, no fuzzing harness, no threat model — just a strcpy that shipped into millions of homes.

The EOL response from TRENDnet, while technically defensible, underscores a systemic problem: devices with 10–15 year lifespans are abandoned by vendors far earlier than they leave service. Enterprises and ISPs that deployed this hardware a decade ago may still have units in active service, now permanently exposed to a public exploit with no official remediation path.

For security teams, this class of vulnerability should be a forcing function to establish hardware lifecycle policies that trigger replacement when a device reaches EOL — not when it fails. Unpatched, network-reachable hardware with publicly available exploits should be treated with the same urgency as an unpatched critical CVE in production software.

Detection with SAST

SAST tooling targets this vulnerability class under CWE-121: Stack-based Buffer Overflow, which is a child of CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Offensive360’s analysis engine flags the following code patterns during C/C++ firmware analysis:

• Unsafe sink functions receiving tainted data: strcpy, strcat, gets, sprintf, vsprintf called with an argument that traces back to an environment variable (getenv), a socket read, or a CGI parameter parse function.
• Taint propagation from HTTP input sources (CGI QUERY_STRING, CONTENT_LENGTH-bounded reads, nvram_get wrappers) through to stack-allocated buffers without an intervening length check.
• Missing bound enforcement — specifically, the absence of strncpy/strlcpy/snprintf or an explicit strlen guard before the copy operation.

When analyzing firmware binaries where source is unavailable, binary SAST augments this with pattern matching on MIPS instruction sequences: identification of fixed-offset stack allocations followed by jal strcpy calls where the source operand register is populated from a network-facing read syscall.

Rule category: OFFSEC-C-BOF-STACK / CWE-121, severity threshold: Critical when the taint source is network-reachable without authentication.

References

• GitHub — TRENDnet TEW-635BRM device_name BOF (PoC)
• VulDB — CVE-2026-15480
• VulDB — Submission 838236
• VulDB — Vulnerability 377787
• VulDB — CTI Entry 377787