TRENDnet TEW-432BRP CVE-2026-10182

Exploitation requires two concrete prerequisites: (1) network-level reachability to the device's HTTP web management interface, and (2) a low-privileged authenticated session on the device (confirmed by CVSS PR:L). The CVSS vector confirms no user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special sequencing is needed beyond satisfying the authentication requirement. The primary limiting factor is credential possession - the attacker must authenticate to the management interface at minimum low-privilege level; devices using default or weak credentials face significantly higher exploitation likelihood. The vulnerable code path is triggered through the wireless LAN setup workflow specifically (/goform/formWlanSetup), so this endpoint must be accessible. No special non-default firmware configuration is required beyond the standard management interface being reachable. Exploitation is further limited to the device's local security scope (S:U), meaning successful compromise does not automatically pivot to adjacent network resources through the vulnerability itself.

The CVSS 3.1 base score of 6.3 (Medium) reflects network-reachable exploitation (AV:N) with low attack complexity (AC:L), no user interaction required (UI:N), and a limited blast radius with confidentiality, integrity, and availability all rated Low - partially explained by the unchanged scope (S:U). The authentication requirement of low privileges (PR:L) is the primary technical constraint on exploitation. No EPSS data was provided in the available intelligence, so exploitation probability cannot be quantified numerically. The CVE is not in the CISA KEV catalog, indicating no confirmed widespread active exploitation. However, the publicly available GitHub proof-of-concept significantly lowers the practical barrier for opportunistic attackers. The decisive risk amplifier is the permanent absence of a patch: TRENDnet's explicit refusal to remediate means every deployed device will remain vulnerable indefinitely. Organizations running this hardware on internet-facing interfaces or insufficiently segmented networks face elevated practical risk that the Medium CVSS score understates. The CVSS temporal metric RL:X (remediation level undefined) aligns with the confirmed no-fix posture.

An attacker with low-privileged credentials to the TEW-432BRP web management interface - obtainable via default credentials, credential stuffing, or brute force against the aging device - submits a crafted HTTP POST request to /goform/formWlanSetup with shell metacharacters or command separators embedded in the enrollee parameter. The firmware's unsanitized command construction passes the injected payload to a system shell, executing attacker-controlled commands with the privileges of the web server process. A publicly available proof-of-concept on GitHub (https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_19/19.md) demonstrates the technique, making this accessible to low-skill threat actors.