CVE-2026-10180: Command Injection in TRENDnet TEW-432BRP
CVE-2026-10180 is a command injection vulnerability in the TRENDnet TEW-432BRP router firmware version 3.10B20. The vulnerability exists in the formSysCmd function at the /goform/formSysCmd endpoint, where manipulation of the sysCmd argument allows remote attackers to execute arbitrary commands. The product has been end-of-life (EOL) since 2009, and the vendor has stated they will not provide a fix or replicate the issue. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity.
AI Analysis
Technical Summary
This vulnerability affects the TRENDnet TEW-432BRP router running firmware version 3.10B20. It allows remote command injection via the sysCmd parameter in the formSysCmd function, enabling attackers to execute arbitrary commands on the device. The product has been EOL for over 15 years, and the vendor does not provide patches or fixes. The vulnerability is publicly known but no active exploitation has been confirmed.
Potential Impact
Successful exploitation could allow remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption. However, the impact is limited to devices still running this outdated and unsupported firmware version. No known exploits in the wild have been reported.
Mitigation Recommendations
No official fix or patch is available due to the product's end-of-life status. Users are advised to replace the affected device with a supported model to mitigate the risk. Since the vendor does not provide remediation, discontinuing use of the vulnerable device is the primary mitigation.
CVE-2026-10180: Command Injection in TRENDnet TEW-432BRP
Description
CVE-2026-10180 is a command injection vulnerability in the TRENDnet TEW-432BRP router firmware version 3.10B20. The vulnerability exists in the formSysCmd function at the /goform/formSysCmd endpoint, where manipulation of the sysCmd argument allows remote attackers to execute arbitrary commands. The product has been end-of-life (EOL) since 2009, and the vendor has stated they will not provide a fix or replicate the issue. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the TRENDnet TEW-432BRP router running firmware version 3.10B20. It allows remote command injection via the sysCmd parameter in the formSysCmd function, enabling attackers to execute arbitrary commands on the device. The product has been EOL for over 15 years, and the vendor does not provide patches or fixes. The vulnerability is publicly known but no active exploitation has been confirmed.
Potential Impact
Successful exploitation could allow remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption. However, the impact is limited to devices still running this outdated and unsupported firmware version. No known exploits in the wild have been reported.
Mitigation Recommendations
No official fix or patch is available due to the product's end-of-life status. Users are advised to replace the affected device with a supported model to mitigate the risk. Since the vendor does not provide remediation, discontinuing use of the vulnerable device is the primary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-30T16:28:24.792Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1c2396e29bf47b5008ef9c
Added to database: 05/31/2026, 12:03:34 UTC
Last enriched: 06/07/2026, 20:59:10 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.