CVE-2026-10182

Vulnerability

A command injection vulnerability exists in the formWlanSetup function within the /goform/formWlanSetup endpoint of TRENDnet TEW-432BRP firmware version 3.10B20. The enrollee argument is directly passed to an OS command without sanitization, allowing an attacker to inject arbitrary shell commands. The affected product has been end-of-life (EOL) since 2009 and is no longer supported by the vendor [1].

Exploitation

An attacker with network access to the router's web management interface can send a crafted POST request to /goform/formWlanSetup. The enrollee parameter, when wrapped in backticks or other command substitution characters, causes the injected command to execute. The exploit requires no authentication if default credentials are used, but the management interface is typically protected; however, default credentials (admin/admin) are commonly known and often unchanged. A publicly available proof-of-concept demonstrates injection of the reboot command [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the device with root privileges. This can lead to full compromise of the router, including data exfiltration, denial of service, or use as a pivot point for further attacks on the local network. The vulnerability is remotely exploitable and has a CVSS v3 score of 6.3 (Medium) [1].

Mitigation

The vendor has confirmed that the TRENDnet TEW-432BRP is end-of-life and no security patches will be issued. Users are strongly advised to replace the device with a supported model. No workarounds exist, and the vulnerability is publicly known. As of the publication date, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1].