PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10061 TRENDnet CVE debrief

A command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the formWPS function within the /goform/formWPS endpoint, where the peerPin parameter is improperly sanitized, allowing remote attackers to inject and execute arbitrary commands. The vendor has explicitly stated this product reached end-of-life in 2009 and will not receive patches. The CVSS 4.0 score of 2.1 (LOW) reflects limited impact scope, though the public availability of exploit details increases practical risk for any remaining deployed units.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations with legacy network infrastructure, managed service providers maintaining client router deployments, security teams responsible for asset lifecycle management, and compliance officers tracking unsupported equipment in regulated environments.

Technical summary

The TRENDnet TEW-432BRP firmware 3.10B20 contains a command injection vulnerability in the formWPS function accessible via /goform/formWPS. The peerPin parameter accepts unsanitized input that is passed to shell execution contexts. Attackers with network access and valid credentials (or in configurations without authentication) can inject shell metacharacters to execute arbitrary commands with the privileges of the web server process. The product has been end-of-life since 2009; the vendor has declined to provide fixes.

Defensive priority

low

Recommended defensive actions

  • Remove or replace TRENDnet TEW-432BRP devices from all networks immediately; no vendor patch will be issued due to 15-year EOL status.
  • Block or restrict access to router management interfaces (including /goform/formWPS) at network boundaries; implement strict ingress filtering for TCP/UDP ports 80 and 443 if web management cannot be disabled.
  • Deploy network segmentation to isolate any remaining EOL router deployments from critical infrastructure and sensitive data zones.
  • Monitor for anomalous command execution patterns or unexpected outbound connections originating from legacy router IP addresses.
  • Inventory and audit all network equipment for EOL status; establish lifecycle management policies to prevent extended deployment of unsupported hardware.

Evidence notes

Vulnerability confirmed via Vuldb submission and public disclosure repository. Vendor EOL statement documented in CVE description. CVSS 4.0 vector indicates network attack vector with low privileges required and low impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10061 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10061

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10061 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10061

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.