CVE-2026-10060 TRENDnet TEW-432BRP formSetRoute command injection

Medium 5.3 Published 29 May 2026 Updated 29 May 2026

Remote attackers can execute arbitrary commands on the TRENDnet TEW-432BRP router via the formSetRoute endpoint, but the device is end-of-life and unsupported.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-10060?

CVE-2026-10060 is a medium-severity command injection vulnerability in TRENDnet TEW-432BRP, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/gateway leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-77, CWE-74

Which versions are affected by CVE-2026-10060?

It affects 1 product.

Products include Trendnet Tew-432brp Firmware.

How do I fix CVE-2026-10060?

No fix has been published for CVE-2026-10060 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-10060 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10060 exists.

Sources

Also known as GHSA-gp64-q6gp-h6g8.