Is there a public PoC exploit available for EUVD-2026-33312?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33312. Prioritise patching immediately. EPSS: 0.8%.

TRENDnet TEW-432BRP EUVD-2026-33312

Q: What is the CVSS score of EUVD-2026-33312?

EUVD-2026-33312 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-10060 LOW

Command Injection (CWE-77)

2026-05-29 VulDB

GHSA-gp64-q6gp-h6g8

Command Injection Tew 432Brp

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:36 vuln.today

Severity Changed

May 29, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 29, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/gateway leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Command injection in TRENDnet TEW-432BRP firmware 3.10B20 allows network-reachable authenticated attackers to execute arbitrary OS commands by injecting shell metacharacters into the ip, mask, or gateway parameters of the formSetRoute CGI handler at /goform/formSetRoute. A public proof-of-concept exploit has been disclosed on GitHub. No patch will ever be released - TRENDnet has explicitly confirmed the device reached end-of-life in 2009 and is unable to replicate or remediate the vulnerability, making permanent residual risk the defining characteristic of this CVE.

Technical ContextAI

The TRENDnet TEW-432BRP is a consumer wireless router with firmware 3.10B20, identified by CPE cpe:2.3:a:trendnet:tew-432brp:*:*:*:*:*:*:*:*. The vulnerable code path is the formSetRoute CGI handler at /goform/formSetRoute, a form-processing routine common to embedded router firmware that handles IPv4 routing table configuration. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: user-supplied values for ip, mask, and gateway parameters are passed unsanitized into a downstream shell invocation - likely a system() or popen() call - without stripping or escaping shell metacharacters. This pattern is endemic to legacy embedded firmware built without modern input validation libraries, and is particularly dangerous in routing configuration handlers that inherently interact with OS-level networking commands.

RemediationAI

No vendor-released patch exists and none will ever be provided - TRENDnet has explicitly confirmed this product has been end-of-life since 2009 and cannot issue a fix. The primary and only durable remediation is device replacement with a currently supported router model. As immediate compensating controls pending replacement: restrict access to the router's web management interface (typically TCP 80/443) using upstream firewall rules to limit reachability to trusted management hosts only, which reduces exposure but does not eliminate risk for internally-positioned attackers who already hold low-privilege credentials. Disabling any remote management or WAN-side web interface features reduces the network-accessible attack surface. Rotating or hardening router credentials limits the PR:L exploitation prerequisite. All compensating controls are inherently temporary mitigations and do not substitute for retiring this hardware.