TRENDnet TEW-432BRP CVE-2026-10063

Exploitation requires (1) network reachability to the router's HTTP management interface, which is LAN-side by default but is often exposed to the WAN on misconfigured consumer devices, (2) valid low-privilege credentials to the web UI per CVSS PR:L - commonly the unchanged factory default on this product class, and (3) the vulnerable /goform/formWPS endpoint being reachable, which is the case in stock firmware 3.10B20 regardless of whether WPS is actively in use, since the handler is registered at boot. Limiting factors: the device must be a TRENDnet TEW-432BRP running firmware 3.10B20, the attacker must traverse any upstream NAT/firewall to reach the management port, and the credential requirement (PR:L) excludes purely unauthenticated mass scanning unless defaults are in place.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 (High) and reflects network-reachable exploitation with low attack complexity but requiring low privileges (PR:L) - meaning a valid web-UI credential is needed, which on consumer routers is frequently the default admin/admin or a weak user-set password. E:P (Proof-of-Concept) in the vector and the linked GitHub writeup confirm publicly available exploit code exists, which is distinct from active in-the-wild exploitation; no KEV listing or EPSS score is included in the provided intelligence, so widespread automated exploitation cannot be confirmed from this data. The decisive risk factor is the vendor's explicit refusal to patch (EOL since 2009): any internet-exposed device is permanently vulnerable, which historically attracts botnet operators (Mirai-class) who routinely chain weak default credentials with router-specific overflows. Net assessment: not a top-of-queue enterprise issue, but a hard end-of-life decision point for any environment still running this hardware.

An attacker who has obtained or guessed a valid management credential (often a default such as admin/admin on legacy SOHO routers) sends an HTTP POST to /goform/formWPS with an oversized peerPin parameter, overflowing the stack buffer in formWPS and overwriting the saved return address to redirect execution into attacker-supplied shellcode. Because public POC code is referenced on GitHub, the exploit is reproducible without independent vulnerability research, and successful exploitation yields code execution on the router with the privileges of the web server process - typically root on embedded devices - enabling traffic interception, DNS hijacking, or recruitment into a botnet.