CVE-2026-10180

Vulnerability

A command injection vulnerability exists in the formSysCmd function within the /goform/formSysCmd file of the TRENDnet TEW-432BRP router running firmware version 3.10B20 [1]. The function passes the sysCmd argument directly to the operating system without proper sanitization, enabling an attacker to inject arbitrary commands [1]. This product has been end-of-life since 2009 and is no longer supported by the vendor [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted POST request to /goform/formSysCmd with a malicious sysCmd parameter [1]. The attacker does not need prior authentication beyond the default credentials which are commonly unchanged [1]. The proof-of-concept includes setting sysCmd to ` reboot ` to trigger a device reboot [1]. No user interaction is required, and the attack can be launched from the local network [1].

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands with the privileges of the web server process (likely root), leading to full compromise of the device [1]. This can result in denial of service, information disclosure, or further attacks on the network [1]. Because the product is end-of-life, no security updates are available [1].

Mitigation

No patch will be released by TRENDnet, as the TEW-432BRP has been end-of-life since 2009 and the vendor states they are unable to replicate or fix vulnerabilities [1]. The only recommended mitigation is to retire and replace the device with a currently supported model [1]. The device is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date [1].