CVE-2026-10061: TRENDnet TEW-432BRP Firmware RCE Flaw

CVE-2026-10061 Overview

CVE-2026-10061 is a command injection vulnerability in the TRENDnet TEW-432BRP wireless router running firmware version 3.10B20. The flaw resides in the formWPS function within /goform/formWPS, where the peerPin argument is passed to a system command without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary operating system commands. The vendor has confirmed the product reached end-of-life (EOL) in 2009 and will not issue a patch. The exploit details have been published, increasing the risk of opportunistic abuse against exposed devices.

Critical Impact
Authenticated attackers can execute arbitrary commands on affected TRENDnet TEW-432BRP routers via the peerPin parameter, with no vendor patch forthcoming due to EOL status.

Affected Products

TRENDnet TEW-432BRP hardware (all units)
TRENDnet TEW-432BRP firmware version 3.10B20
All TEW-432BRP deployments still in production use (EOL since 2009)

Discovery Timeline

2026-05-29 - CVE-2026-10061 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10061

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the formWPS handler exposed at the HTTP endpoint /goform/formWPS in the router's web administration interface. This handler processes Wi-Fi Protected Setup (WPS) configuration requests submitted by authenticated administrators.

When the handler receives the peerPin form field, the value is concatenated into a shell command string and passed to a system call without input validation or escaping. Shell metacharacters such as ;, |, &, and backticks are interpreted by the underlying shell, allowing arbitrary command execution in the context of the web server process, which typically runs with root privileges on embedded routers.

Root Cause

The root cause is missing input sanitization on the peerPin parameter inside formWPS. Embedded router firmware frequently invokes system utilities through system() or popen() calls built with sprintf-style string concatenation. Without an allowlist or proper escaping of user-supplied data, any attacker-controlled payload is interpreted by the shell.

Attack Vector

Exploitation requires network access to the router's management interface and valid low-privilege credentials. An attacker submits a crafted POST request to /goform/formWPS with a peerPin value containing shell metacharacters and follow-on commands. The injected commands execute on the device, enabling persistence, traffic interception, lateral movement into the internal network, or recruitment into a botnet. Public exploit details lower the barrier to weaponization. Because the device is EOL, no firmware update will be issued by the vendor. See the GitHub vulnerability report and VulDB #367147 for technical write-ups.

Detection Methods for CVE-2026-10061

Indicators of Compromise

HTTP POST requests to /goform/formWPS containing shell metacharacters (;, |, &, backticks, $()) in the peerPin field
Outbound connections from router management IPs to unknown infrastructure following WPS configuration requests
Unexpected processes or cron entries on the router, where shell access is available

Detection Strategies

Inspect web server access logs on the router or upstream proxies for requests to /goform/formWPS with anomalous peerPin values exceeding expected PIN length or containing non-numeric characters
Deploy network IDS signatures (Snort/Suricata) that match command injection patterns in HTTP request bodies destined for TRENDnet management interfaces
Baseline DNS queries and outbound traffic originating from the router subnet to identify post-exploitation callbacks

Monitoring Recommendations

Forward router syslog and management-plane traffic to a central SIEM for retention and correlation
Alert on any HTTP request to /goform/formWPS from clients outside the administrative subnet
Monitor for new listening ports or reverse shells originating from router IP addresses

How to Mitigate CVE-2026-10061

Immediate Actions Required

Decommission TRENDnet TEW-432BRP devices and replace them with a supported router model, since no patch will be released
Until replacement, restrict access to the web management interface to a single trusted host on the LAN and disable WAN-side administration
Rotate administrator credentials and disable WPS functionality if the configuration permits
Segment the router from sensitive internal assets using VLANs or a dedicated firewall

Patch Information

No patch is available. The vendor has stated that the TEW-432BRP has been EOL since 2009 and will not receive security fixes. Replacement with a currently supported device is the only definitive remediation.

Workarounds

Block external access to TCP/80 and TCP/443 on the router's WAN interface
Use firewall ACLs to restrict /goform/formWPS access to specific administrator workstations
Disable remote management features entirely if the firmware allows
Place the device behind an upstream firewall that filters HTTP request bodies for shell metacharacters targeting /goform/ endpoints

bash

# Example upstream firewall rule (iptables) limiting management access
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_workstation_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP