Is there a public PoC exploit available for CVE-2026-10180?

Yes, a public proof-of-concept exploit is available for CVE-2026-10180. Prioritise patching immediately. EPSS: 1.1%.

TRENDnet TEW-432BRP CVE-2026-10180

Q: What is the CVSS score of CVE-2026-10180?

CVE-2026-10180 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-33500 LOW

Command Injection (CWE-77)

2026-05-31 VulDB

GHSA-jxjp-7j6j-636j

Command Injection Tew 432Brp

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 12:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 31, 2026 - 12:15 vuln.today

DescriptionCVE.org

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSysCmd of the file /goform/formSysCmd. Such manipulation of the argument sysCmd leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in TRENDnet TEW-432BRP firmware 3.10B20 enables remote attackers with low-privilege credentials to execute arbitrary OS commands by injecting shell metacharacters into the sysCmd parameter of the /goform/formSysCmd endpoint. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation. The vendor has confirmed no patch will be released - the device has been end-of-life since 2009 - meaning any remaining deployed units are permanently unpatched.

Technical ContextAI

The TEW-432BRP is a consumer-grade SOHO router whose firmware exposes a CGI-based web management interface. The vulnerable function formSysCmd, located at /goform/formSysCmd, accepts a sysCmd HTTP parameter and passes it to an underlying system call without adequate sanitization of shell metacharacters, a textbook instance of CWE-77 (Improper Neutralization of Special Elements Used in a Command). This pattern is endemic to legacy embedded Linux router firmware that directly shells out web form inputs. The CPE string cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:* uses a wildcard version field, indicating that version scoping was not precisely defined by the reporter or vendor, and all firmware versions should be treated as potentially affected.

RemediationAI

No vendor-released patch is available and none will be issued, as TRENDnet has declared the TEW-432BRP end-of-life since 2009. The primary and strongly recommended remediation is immediate device replacement with a currently supported router model. Where immediate replacement is not feasible, the following compensating controls should be applied: disable remote (WAN-side) web management access if enabled, as this limits exploitation to the local network only; restrict access to the router's management interface to a dedicated management VLAN or specific trusted IP addresses using upstream firewall ACLs; enforce strong, unique credentials on the management interface to raise the barrier for the required PR:L authentication; and isolate the device in a segmented network zone to limit lateral movement if the device is compromised. Note that none of these controls eliminate the vulnerability - they only reduce exposure. Reference: https://vuldb.com/vuln/367461 and POC: https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_17/17.md.