PatchSiren cyber security CVE debrief
CVE-2026-10061 TRENDnet CVE debrief
A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the formWPS function within the /goform/formWPS endpoint, where the peerPin parameter is improperly sanitized, allowing remote attackers to inject and execute arbitrary commands. The vendor has explicitly stated this product reached end-of-life in 2009 and will not receive patches. The CVSS 4.0 score of 2.1 (LOW) reflects limited impact scope, though the public availability of exploit details increases practical risk for any remaining deployed units.
- Vendor
- TRENDnet
- Product
- TEW-432BRP
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations with legacy network infrastructure, managed service providers maintaining client router deployments, security teams responsible for asset lifecycle management, and compliance officers tracking unsupported equipment in regulated environments.
Technical summary
The TRENDnet TEW-432BRP firmware 3.10B20 contains a command injection vulnerability in the formWPS function accessible via /goform/formWPS. The peerPin parameter accepts unsanitized input that is passed to shell execution contexts. Attackers with network access and valid credentials (or in configurations without authentication) can inject shell metacharacters to execute arbitrary commands with the privileges of the web server process. The product has been end-of-life since 2009; the vendor has declined to provide fixes.
Defensive priority
low
Recommended defensive actions
- Remove or replace TRENDnet TEW-432BRP devices from all networks immediately; no vendor patch will be issued due to 15-year EOL status.
- Block or restrict access to router management interfaces (including /goform/formWPS) at network boundaries; implement strict ingress filtering for TCP/UDP ports 80 and 443 if web management cannot be disabled.
- Deploy network segmentation to isolate any remaining EOL router deployments from critical infrastructure and sensitive data zones.
- Monitor for anomalous command execution patterns or unexpected outbound connections originating from legacy router IP addresses.
- Inventory and audit all network equipment for EOL status; establish lifecycle management policies to prevent extended deployment of unsupported hardware.
Evidence notes
Vulnerability confirmed via Vuldb submission and public disclosure repository. Vendor EOL statement documented in CVE description. CVSS 4.0 vector indicates network attack vector with low privileges required and low impact on confidentiality, integrity, and availability.
Official resources
2026-05-29