PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10180 TRENDnet CVE debrief

A remote command injection vulnerability exists in the TRENDnet TEW-432BRP wireless router firmware version 3.10B20. The vulnerability resides in the `formSysCmd` function within the `/goform/formSysCmd` endpoint, where unsanitized input passed to the `sysCmd` parameter permits arbitrary OS command execution. The affected product reached end-of-life (EOL) in 2009—approximately 15 years prior to disclosure—and the vendor has stated it cannot replicate or remediate the issue. The CVSS 4.0 base score of 2.1 (LOW) reflects limited privileges required and low impact on confidentiality, integrity, and availability, though the exploit is publicly disclosed and functional. No CISA KEV listing or known ransomware campaign use is present.

Vendor
TRENDnet
Product
TEW-432BRP
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations operating legacy network infrastructure, particularly small-office/home-office (SOHO) deployments still utilizing TRENDnet TEW-432BRP routers. Security teams responsible for asset lifecycle management and network segmentation. Managed service providers supporting environments with unmanaged or aged hardware.

Technical summary

The `formSysCmd` function in `/goform/formSysCmd` fails to sanitize the `sysCmd` argument, allowing an authenticated or otherwise authorized remote attacker to inject and execute arbitrary operating system commands on the TRENDnet TEW-432BRP device. The vulnerability is exploitable over the network and a public proof-of-concept exists. The product has been end-of-life since 2009, and the vendor has explicitly declined to provide a fix.

Defensive priority

low

Recommended defensive actions

  • Remove or replace TRENDnet TEW-432BRP devices from all networks; no vendor patch will be issued due to 15-year EOL status.
  • Block or restrict access to the `/goform/formSysCmd` endpoint at network boundaries if device replacement is not immediately feasible.
  • Segment EOL devices into isolated network zones with no external inbound access and minimal lateral movement paths.
  • Monitor for unauthorized access attempts or anomalous traffic targeting router management interfaces, particularly HTTP/HTTPS requests to `/goform/formSysCmd`.
  • Inventory network infrastructure for additional EOL or unsupported equipment and prioritize replacement based on exposure to untrusted networks.

Evidence notes

Vendor EOL statement is reproduced from the CVE description field. CVSS vector and weakness enumerations (CWE-74, CWE-77) are sourced from NVD metadata. Exploit disclosure is confirmed by reference to a public GitHub repository. Vendor attribution to TRENDnet is derived from the CVE description and reference materials; the vendor field in source metadata is marked low-confidence and flagged for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10180 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10180

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10180 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10180

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.