CVE-2026-10060: TRENDnet TEW-432BRP Command Injection—End-of-Life Router Vulnerability

Technical summary

The vulnerability exists in the /goform/formSetRoute handler, which processes route configuration requests. The function fails to properly validate or sanitize the ip, mask, and gateway input parameters before using them in system commands. This allows command injection (CWE-74, CWE-77) via specially crafted requests. Exploitation requires authenticated network access to the router's management interface. The attack surface is the HTTP-based configuration interface accessible to users with valid credentials.

Business impact

Organizations still operating TEW-432BRP routers face a significant operational risk. An attacker with administrative or user-level access to the router could gain command execution, potentially compromising network segmentation, intercepting traffic, or using the device as a pivot point. For networks relying on these legacy devices, the inability to obtain vendor patches means risk mitigation depends entirely on network access controls and credential management. Continued use increases long-term security exposure without remediation options.

Affected systems

Only the TRENDnet TEW-432BRP router running firmware version 3.10B20 and related builds is affected. This is a legacy consumer/small-business wireless router. The TEW-432BRP is no longer manufactured or supported. Any organization still operating this hardware in production is exposed, though the device's age suggests limited modern deployment.

Exploitability

The vulnerability requires authenticated access—an attacker must possess valid router credentials. Exploit code has been disclosed publicly, reducing the barrier to weaponization. However, the authentication requirement prevents unauthenticated remote exploitation. Risk is highest in environments with weak credential hygiene, default passwords, or exposed management interfaces. The CVSS 3.1 score of 6.3 (MEDIUM) reflects this authentication prerequisite balanced against the ability to execute commands post-authentication.

Remediation

The vendor has explicitly stated no patches will be released due to the product's end-of-life status. Organizations have two paths: (1) Immediately decommission TEW-432BRP devices and replace them with current hardware receiving active vendor support, or (2) If replacement is not immediately feasible, isolate the router on a restricted network segment, disable remote management access, enforce strong unique credentials, and monitor for unauthorized configuration changes. Replacement is the only permanent solution.

Patch guidance

No patch is available from the vendor. The TEW-432BRP reached end-of-life in 2009 and vendor support has formally ended. Do not delay remediation expecting a security update. Organizations must develop a decommissioning plan and transition to supported hardware. Verify your current router model and firmware version against the affected product list; if you are running this model, prioritize replacement in your asset lifecycle plan.

Detection guidance

Monitor for suspicious HTTP POST requests to /goform/formSetRoute with unusual or malformed parameters in the ip, mask, or gateway fields. Network-based intrusion detection should flag requests containing command injection payloads (backticks, $(), semicolons, or pipe operators) in these parameters. Check router access logs for successful logins followed by configuration changes. Passive scanning can identify deployed TEW-432BRP devices via banner grabbing on port 80; use this to locate affected assets for retirement planning.

Why prioritize this

Although rated MEDIUM severity due to the authentication requirement, this vulnerability should be prioritized for asset retirement, not patching. The key drivers are: (1) Lack of any remediation path from the vendor, (2) Publicly disclosed exploit code, (3) The device's extreme age and lack of modern security controls, and (4) The risk of credential compromise enabling persistent command execution. Any TEW-432BRP still in operation represents technical debt and should be replaced urgently.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible command injection flaw that requires prior authentication (Attack Vector: Network, Access Complexity: Low, Privileges Required: Low). This yields low confidentiality, integrity, and availability impact but does not capture the compounding risk of end-of-life status and lack of vendor support. The true organizational risk is higher because no patch is available and the device is likely running unpatched for many other undiscovered vulnerabilities typical of 15-year-old consumer hardware.

Frequently asked questions