Is there a public PoC exploit available for CVE-2026-10182?

Yes, a public proof-of-concept exploit is available for CVE-2026-10182. Prioritise patching immediately. EPSS: 0.9%.

TRENDnet TEW-432BRP CVE-2026-10182

Q: What is the CVSS score of CVE-2026-10182?

CVE-2026-10182 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-33504 LOW

Command Injection (CWE-77)

2026-05-31 VulDB

GHSA-8mm7-wgg4-c7ff

Command Injection Tew 432Brp

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 31, 2026 - 13:51 vuln.today

DescriptionCVE.org

A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formWlanSetup of the file /goform/formWlanSetup. Executing a manipulation of the argument enrollee can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in TRENDnet TEW-432BRP firmware 3.10B20 allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the enrollee parameter in the /goform/formWlanSetup wireless configuration handler. The product reached end-of-life in 2009, and TRENDnet has formally and explicitly declined to issue a patch, leaving all deployed units permanently unpatched with no vendor remediation path. Publicly available exploit code exists on GitHub, materially lowering the exploitation barrier, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

The vulnerability resides in the formWlanSetup function within the /goform/formWlanSetup CGI endpoint - a web interface handler used to configure the device's wireless LAN settings. CWE-77 (Improper Neutralization of Special Elements Used in a Command) identifies the root cause: the firmware passes the attacker-controlled enrollee parameter directly into a system shell command without adequate sanitization or escaping of metacharacters. This class of flaw is endemic to legacy embedded router firmware where configuration values are naively concatenated with shell commands rather than passed as isolated arguments. The affected CPE is cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:*, with a wildcard version field indicating the TEW-432BRP platform broadly, though the specific confirmed version is firmware 3.10B20.

RemediationAI

No vendor-released patch has been identified at time of analysis - TRENDnet has explicitly confirmed they will not provide a fix due to the product's 15-year end-of-life status. The definitive remediation is hardware replacement with a currently supported router model from any vendor actively providing security updates. Where immediate replacement is not feasible, restrict access to the device's web management interface at the network perimeter: configure upstream firewall rules to block all inbound access to the device's HTTP management port from untrusted networks and external IP ranges, preventing exploitation of the /goform/ endpoint. If the device offers a setting to disable remote management or bind the admin interface to a specific internal IP, enable that restriction immediately - note this reduces but does not eliminate risk if the attacker already has internal network access. Placing the device behind a stateful firewall with default-deny inbound policy limits the attack surface. All compensating controls are temporary by nature given the permanent no-patch posture. Exploit reference: https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_19/19.md. VulDB entry: https://vuldb.com/vuln/367463.