TRENDnet TEW-432BRP CVE-2026-10061

Exploitation requires authenticated access to the router's web administration interface - the CVSS 4.0 vector PR:L confirms low-privilege credentials are sufficient; administrator-level access is not required. The vulnerable code path is specifically the WPS PIN submission function at /goform/formWPS, meaning the WPS configuration feature must be accessible via the admin UI (default on this device class). Attack vector is network (AV:N), so the attacker must have network connectivity to the management interface - typically LAN-side or, if remote management is enabled, from the internet. Exploitation is limited to devices still running this EOL firmware; no impact propagates to adjacent or downstream systems (SC:N/SI:N/SA:N). The primary limiting factor is the PR:L authentication requirement: any attacker who cannot authenticate to the admin interface cannot exploit this vulnerability.

The CVSS 4.0 base score of 2.1 is unusually low for a network-reachable command injection, and the reason is traceable: the vector requires PR:L (low-privilege authentication), and impact is capped at VC:L/VI:L/VA:L with no subsequent system scope (SC:N/SI:N/SA:N). This is not a generic-severity miscategorization - it accurately reflects that an attacker must first authenticate to the router's management interface before exploiting the flaw. No EPSS score was provided in the input data, so exploitation probability cannot be quantified independently. No CISA KEV listing exists, and no widespread exploitation has been reported, but a public POC lowers the barrier for any authenticated attacker. Real-world risk is tightly bounded: exposure requires running hardware that is 15+ years past EOL, and successful exploitation is constrained to the device itself (no lateral scope). For defenders still operating this hardware, the combination of public exploit and permanent no-patch status elevates operational urgency despite the low CVSS score.

An attacker who has obtained or guessed low-privilege credentials to the TEW-432BRP's web administration interface sends a crafted HTTP POST request to /goform/formWPS with a peerPin value containing shell metacharacters (e.g., semicolons or backticks followed by arbitrary commands). The router's CGI handler passes the unsanitized value directly to a system shell, executing the injected command with the web server's process privileges. A working proof-of-concept demonstrating this technique is publicly available at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_2/2.md.