CVE-2026-10061: TRENDnet TEW-432BRP formWPS command injection
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of the argument peerPin results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10061?
The severity of CVE-2026-10061 is medium with a score of 6.3.
How do I fix CVE-2026-10061?
To fix CVE-2026-10061, update the TRENDnet TEW-432BRP firmware to the latest version provided by the vendor.
What does CVE-2026-10061 affect?
CVE-2026-10061 affects the TRENDnet TEW-432BRP router version 3.10B20.
What type of vulnerability is CVE-2026-10061?
CVE-2026-10061 is a command injection vulnerability.
Can CVE-2026-10061 be exploited remotely?
Yes, CVE-2026-10061 can be exploited remotely.