CVE-2026-10060: Trendnet TEW-432BRP RCE Vulnerability

CVE-2026-10060 Overview

CVE-2026-10060 is a command injection vulnerability in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. The flaw resides in the formSetRoute function within /goform/formSetRoute. Attackers can manipulate the ip, mask, or gateway parameters to inject arbitrary operating system commands. Remote exploitation is possible, and the exploit has been publicly disclosed.

TRENDnet has stated the product reached End of Life (EOL) in 2009 and will not receive a fix. The vulnerability only affects this unsupported hardware. Organizations still operating these routers face persistent risk because no vendor patch exists.

Critical Impact
Authenticated remote attackers can inject operating system commands through router configuration parameters, potentially gaining control of the device and the network segments it serves.

Affected Products

TRENDnet TEW-432BRP wireless router (hardware)
TRENDnet TEW-432BRP firmware version 3.10B20
All TEW-432BRP units (EOL since 2009, no further updates)

Discovery Timeline

2026-05-29 - CVE-2026-10060 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10060

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The formSetRoute handler in /goform/formSetRoute processes static route configuration requests submitted through the router's web administration interface. The handler accepts the ip, mask, and gateway parameters and passes them to an underlying system call without sanitization.

Because the parameters reach a shell interpreter unchanged, an attacker can append shell metacharacters to inject additional commands. Successful injection runs in the context of the router's web server process, which on consumer SOHO routers typically runs as root. The attack requires network reachability to the router's administrative interface and low-privilege authentication.

Root Cause

The root cause is missing input validation and unsafe construction of shell commands inside the formSetRoute function. User-controlled values from the route configuration form are concatenated directly into a command string executed by the system shell. No allowlist, escaping, or argument separation protects the call.

Attack Vector

Exploitation occurs over the network against the router's HTTP management interface. An authenticated user submits a crafted POST request to /goform/formSetRoute containing shell metacharacters in the ip, mask, or gateway fields. The injected payload executes on the device, enabling persistence, traffic interception, lateral movement, or use of the router as a pivot. Technical proof-of-concept details are documented in the GitHub Vulnerability Documentation and VulDB entry #367146.

Detection Methods for CVE-2026-10060

Indicators of Compromise

HTTP POST requests to /goform/formSetRoute containing shell metacharacters such as ;, |, &, `, or $( in the ip, mask, or gateway parameters.
Unexpected outbound connections originating from the router's management IP address.
Unauthorized changes to routing tables, DNS settings, or administrative credentials on the device.

Detection Strategies

Inspect network traffic for HTTP requests to the router's /goform/formSetRoute endpoint and alert on non-numeric characters in IP, mask, and gateway fields.
Monitor router syslog or remote logging streams for unexpected process executions or configuration changes.
Correlate router behavior against a baseline of administrative activity to flag exploitation attempts from unexpected source addresses.

Monitoring Recommendations

Place EOL network devices on isolated VLANs and monitor all ingress and egress traffic with network detection tooling.
Forward router logs to a centralized logging platform and create alerts for repeated POST requests to /goform/* endpoints.
Track DNS and routing changes that could indicate post-exploitation tampering.

How to Mitigate CVE-2026-10060

Immediate Actions Required

Remove the TRENDnet TEW-432BRP from production networks and replace it with a vendor-supported router that receives security updates.
If immediate replacement is not possible, disable remote administration and restrict the management interface to a single trusted host.
Change all administrative credentials on the device and audit configured static routes for unauthorized entries.

Patch Information

No patch will be released. TRENDnet has confirmed the TEW-432BRP has been EOL since 2009 and the vendor cannot replicate or fix vulnerabilities in this product. Replacement is the only supported remediation path.

Workarounds

Segment the affected router behind a supported firewall and block external access to the HTTP management interface.
Restrict administrative access to a dedicated management VLAN with explicit allowlist rules.
Disable unused services and ensure default credentials have been changed if the device must remain in temporary use.

bash

# Example firewall rule (iptables) to restrict access to the router's web UI
# Replace ROUTER_IP and MGMT_HOST with appropriate values
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -s MGMT_HOST -j ACCEPT
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -j DROP