PatchSiren cyber security CVE debrief
CVE-2026-10180 TRENDnet CVE debrief
A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the `formSysCmd` function within the `/goform/formSysCmd` endpoint, where unsanitized input passed to the `sysCmd` parameter permits arbitrary OS command execution. The affected product reached end-of-life (EOL) in 2009—approximately 15 years prior to disclosure—and the vendor has stated it cannot replicate or remediate the issue. The CVSS 4.0 base score of 2.1 (LOW) reflects limited privileges required and low impact on confidentiality, integrity, and availability, though the exploit is publicly disclosed and functional. No CISA KEV listing or known ransomware campaign use is present.
- Vendor
- TRENDnet
- Product
- TEW-432BRP
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-31
- Original CVE updated
- 2026-05-31
- Advisory published
- 2026-05-31
- Advisory updated
- 2026-05-31
Who should care
Organizations operating legacy network infrastructure, particularly small-office/home-office (SOHO) deployments still utilizing TRENDnet TEW-432BRP routers. Security teams responsible for asset lifecycle management and network segmentation. Managed service providers supporting environments with unmanaged or aged hardware.
Technical summary
The `formSysCmd` function in `/goform/formSysCmd` fails to sanitize the `sysCmd` argument, allowing an authenticated or otherwise authorized remote attacker to inject and execute arbitrary operating system commands on the TRENDnet TEW-432BRP device. The vulnerability is exploitable over the network and a public proof-of-concept exists. The product has been end-of-life since 2009, and the vendor has explicitly declined to provide a fix.
Defensive priority
low
Recommended defensive actions
- Remove or replace TRENDnet TEW-432BRP devices from all networks; no vendor patch will be issued due to 15-year EOL status.
- Block or restrict access to the `/goform/formSysCmd` endpoint at network boundaries if device replacement is not immediately feasible.
- Segment EOL devices into isolated network zones with no external inbound access and minimal lateral movement paths.
- Monitor for unauthorized access attempts or anomalous traffic targeting router management interfaces, particularly HTTP/HTTPS requests to `/goform/formSysCmd`.
- Inventory network infrastructure for additional EOL or unsupported equipment and prioritize replacement based on exposure to untrusted networks.
Evidence notes
Vendor EOL statement is reproduced from the CVE description field. CVSS vector and weakness enumerations (CWE-74, CWE-77) are sourced from NVD metadata. Exploit disclosure is confirmed by reference to a public GitHub repository. Vendor attribution to TRENDnet is derived from the CVE description and reference materials; the vendor field in source metadata is marked low-confidence and flagged for review.
Official resources
public