PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10180 TRENDnet CVE debrief

A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the `formSysCmd` function within the `/goform/formSysCmd` endpoint, where unsanitized input passed to the `sysCmd` parameter permits arbitrary OS command execution. The affected product reached end-of-life (EOL) in 2009—approximately 15 years prior to disclosure—and the vendor has stated it cannot replicate or remediate the issue. The CVSS 4.0 base score of 2.1 (LOW) reflects limited privileges required and low impact on confidentiality, integrity, and availability, though the exploit is publicly disclosed and functional. No CISA KEV listing or known ransomware campaign use is present.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-05-31
Advisory published
2026-05-31
Advisory updated
2026-05-31

Who should care

Organizations operating legacy network infrastructure, particularly small-office/home-office (SOHO) deployments still utilizing TRENDnet TEW-432BRP routers. Security teams responsible for asset lifecycle management and network segmentation. Managed service providers supporting environments with unmanaged or aged hardware.

Technical summary

The `formSysCmd` function in `/goform/formSysCmd` fails to sanitize the `sysCmd` argument, allowing an authenticated or otherwise authorized remote attacker to inject and execute arbitrary operating system commands on the TRENDnet TEW-432BRP device. The vulnerability is exploitable over the network and a public proof-of-concept exists. The product has been end-of-life since 2009, and the vendor has explicitly declined to provide a fix.

Defensive priority

low

Recommended defensive actions

  • Remove or replace TRENDnet TEW-432BRP devices from all networks; no vendor patch will be issued due to 15-year EOL status.
  • Block or restrict access to the `/goform/formSysCmd` endpoint at network boundaries if device replacement is not immediately feasible.
  • Segment EOL devices into isolated network zones with no external inbound access and minimal lateral movement paths.
  • Monitor for unauthorized access attempts or anomalous traffic targeting router management interfaces, particularly HTTP/HTTPS requests to `/goform/formSysCmd`.
  • Inventory network infrastructure for additional EOL or unsupported equipment and prioritize replacement based on exposure to untrusted networks.

Evidence notes

Vendor EOL statement is reproduced from the CVE description field. CVSS vector and weakness enumerations (CWE-74, CWE-77) are sourced from NVD metadata. Exploit disclosure is confirmed by reference to a public GitHub repository. Vendor attribution to TRENDnet is derived from the CVE description and reference materials; the vendor field in source metadata is marked low-confidence and flagged for review.

Official resources

public