TRENDnet TEW-432BRP EUVD-2026-33500

Exploitation requires network-level access to the TEW-432BRP web management interface and valid low-privilege credentials on the device (confirmed by CVSS PR:L). The vulnerable endpoint /goform/formSysCmd must be reachable - if remote (WAN-side) management is disabled, exploitation is constrained to attackers already on the local network segment. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning exploitation is straightforward once credentials are obtained. The key limiting factor is the authentication prerequisite: unauthenticated exploitation is NOT supported by the CVSS vector. Credential acquisition via brute force, credential stuffing, or default credentials would be a prerequisite step.

The CVSS 6.3 score (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - network-exploitable with low complexity but requiring authenticated access (PR:L), which tempers the score relative to unauthenticated variants. The E:P modifier confirms proof-of-concept code exists publicly, elevating practical risk above the base score would suggest. The RC:R (Reasonably Confident) modifier introduces slight uncertainty in independent reproduction. KEV status is not confirmed, meaning widespread active exploitation has not been verified by CISA. However, the permanent absence of a patch combined with public POC availability means any internet-exposed unit with default or weak credentials faces sustained, realistic exploitation risk. This is not a high-CVSS-but-low-real-risk case - the EOL status makes the risk effectively permanent for organizations still running this hardware, and the low complexity means the POC can be operationalized with minimal effort.

An attacker with low-privilege credentials to the TEW-432BRP web interface submits a crafted HTTP POST request to /goform/formSysCmd with shell metacharacters (e.g., semicolons or backtick-delimited commands) appended to the sysCmd parameter value, causing the router firmware to execute attacker-controlled OS commands with the privileges of the web server process. A public proof-of-concept at https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_17/17.md documents the exact request structure, enabling replication with minimal effort.