CVE-2026-10060
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A command injection vulnerability was discovered in TRENDnet TEW-432BRP firmware version 3.10B20. The flaw exists in the formSetRoute function within /goform/formSetRoute, where the ip, mask, and gateway parameters are not properly sanitized. The vendor states the product has been end-of-life for 15 years and will not provide fixes.
Risk Assessment
An unauthenticated remote attacker can execute arbitrary commands on the device, potentially compromising the local network, intercepting traffic, or using the router as a pivot for further attacks.
Recommendation
Immediately decommission all TRENDnet TEW-432BRP devices and replace them with newer, supported models. If replacement is not possible, isolate these devices from the production network and block external access to the management interface.
Original NVD description (English source)
A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/gateway leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.