TRENDnet TEW-432BRP CVE-2026-10060

Exploitation requires the attacker to hold low-privilege authenticated access to the router's web management interface - the CVSS 4.0 vector specifies PR:L (low privileges required), confirming that unauthenticated exploitation is NOT supported by available data. The vulnerable endpoint /goform/formSetRoute must be network-reachable from the attacker's position (AV:N). No user interaction is required once credentials are obtained (UI:N), and attack complexity is low (AC:L) with no timing dependency (AT:N). The exploitation window is limited by two concrete factors: first, the attacker must first acquire valid router credentials (even low-privilege ones such as a guest or read-only account); second, the attack is scoped exclusively to devices still running TRENDnet TEW-432BRP hardware with firmware 3.10B20 - a 15-year EOL product with a diminishing deployment footprint.

Real-world risk is moderate-to-elevated for any environment where this EOL device remains deployed, despite the anomalously low CVSS 4.0 score of 2.1. The low numerical score is primarily driven by the low vulnerable-system impact metrics (VC:L/VI:L/VA:L) and the PR:L (low privileges) requirement, but command injection on router firmware typically confers full device control - the impact classification should be independently verified against the published PoC, as it may underestimate practical severity. The CVSS 4.0 vector components (AV:N/AC:L/AT:N/PR:L/UI:N) alongside the exploit maturity modifier E:P collectively confirm network reachability, low attack complexity, no required user interaction, and the existence of public proof-of-concept code - a combination that meaningfully lowers the exploitation barrier. No EPSS data was provided in source intelligence, and the CVE is not listed in CISA KEV, indicating no confirmed mass exploitation at time of analysis. However, the no-fix status confirmed by the vendor transforms what might otherwise be a patchable medium-severity issue into a permanent architectural risk for any organization still running this hardware.

An attacker who has obtained low-privilege credentials to the router's web management interface sends a crafted HTTP POST request to /goform/formSetRoute, embedding shell metacharacters (e.g., semicolons, backticks, or pipe characters) within the ip, mask, or gateway parameter values. The firmware's formSetRoute handler passes the unsanitized parameter directly into an OS command - such as a route configuration utility - executing attacker-controlled shell instructions with the firmware process's privilege level. A public proof-of-concept demonstrating this exact technique is available at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_1/1.md.