CVE-2026-10061
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A command injection vulnerability was found in TRENDnet TEW-432BRP firmware 3.10B20 in the formWPS function of /goform/formWPS. Manipulating the peerPin argument allows remote command execution. The vendor states the product has been end-of-life for 15 years and will not be patched.
Risk Assessment
An attacker can remotely take over the device, compromising network confidentiality and integrity. Since no patches will be issued, the risk is permanent and requires immediate isolation or hardware replacement.
Recommendation
Immediately retire all TRENDnet TEW-432BRP devices and replace them with newer supported models. If replacement is not possible, isolate them from the production network and block access to the management interface.
Original NVD description (English source)
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of the argument peerPin results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.