CVE-2026-10060
Published: 29 May 2026
Summary
CVE-2026-10060 is a low-severity Injection (CWE-74) vulnerability in Trendnet Tew-432Brp Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability has been identified in the TRENDnet TEW-432BRP router running firmware version 3.10B20. The issue resides in the formSetRoute function within the /goform/formSetRoute endpoint, where improper handling of the ip, mask, and gateway arguments permits command injection. The flaw is tracked under CWE-74 and CWE-77, carries a CVSS 4.0 score of 2.1, and affects only this end-of-life device.
An authenticated remote attacker can supply crafted values to the affected parameters and execute arbitrary commands on the device. Publicly available exploit details demonstrate that successful exploitation grants limited control over routing configuration and underlying system behavior without requiring user interaction.
The vendor has stated that the TEW-432BRP reached end-of-life status in 2009 and will receive no patches or further support, explicitly noting that replication or remediation of the vulnerability is not feasible.
EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0106, indicating emerging exploitation interest after public disclosure of the proof-of-concept.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-33312
Vulnerability details
A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/gateway leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed…
more
to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router web endpoint enables remote exploitation of public-facing application (T1190) and arbitrary command execution on network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.