Is there a public PoC exploit available for CVE-2026-10061?

Yes, a public proof-of-concept exploit is available for CVE-2026-10061. Prioritise patching immediately. EPSS: 0.8%.

TRENDnet TEW-432BRP CVE-2026-10061

Q: What is the CVSS score of CVE-2026-10061?

CVE-2026-10061 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-33316 LOW

Command Injection (CWE-77)

2026-05-29 VulDB

GHSA-x5x3-v9hr-2jhp

Command Injection Tew 432Brp

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:35 vuln.today

Severity Changed

May 29, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 29, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of the argument peerPin results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in TRENDnet TEW-432BRP firmware 3.10B20 allows a low-privileged, network-based attacker to execute arbitrary OS commands on the device by manipulating the peerPin argument submitted to the formWPS CGI handler at /goform/formWPS. A public proof-of-concept exploit is available on GitHub, confirmed by the E:P modifier in the CVSS 4.0 vector. No patch has been or will ever be released - the vendor explicitly confirmed this router reached end-of-life in 2009, making permanent device replacement the only viable remediation.

Technical ContextAI

The TEW-432BRP is a legacy SOHO router whose embedded web server exposes a CGI endpoint, /goform/formWPS, that handles Wi-Fi Protected Setup (WPS) PIN configuration. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that the peerPin parameter - a WPS PIN value provided by the user - is concatenated into a shell command without sanitization, allowing an attacker to break out of the intended command context and inject arbitrary shell metacharacters. The affected CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:* covers all tracked versions. The CVSS 4.0 E:P modifier in the vector independently corroborates the existence of functional public exploit code.

RemediationAI

No vendor-released patch exists and none will be issued - TRENDnet explicitly stated the product has been EOL since 2009. The primary and only sustainable remediation is to replace the TEW-432BRP with a currently supported router model. If immediate replacement is not feasible, restrict all access to the router's web administration interface by placing it on an isolated management VLAN and blocking remote access from untrusted hosts at the network perimeter - this directly targets the PR:L authentication prerequisite by preventing unauthorized users from reaching the login interface in the first place. Additionally, disable WPS on the device if the firmware UI allows it, which removes the specific vulnerable handler from the attack surface, though this may not be possible on all firmware builds. Note that neither workaround addresses the underlying code defect, and both should be treated as temporary measures only. VulDB submission: https://vuldb.com/submit/814757.