CVE-2026-10060 is a medium (CVSS 6.3) command injection in the TRENDnet TEW-432BRP router, firmware 3.10B20, reachable through its web interface. TRENDnet says the product has been end of life since 2009 and it cannot fix it. There is no patch, so the fix is to replace the device and isolate it in the meantime.
What's affected
The record names the TRENDnet TEW-432BRP wireless router, firmware 3.10B20, and the /goform/formSetRoute handler in its web interface. Other firmware revisions are not mentioned in the record.
There is no fixed version. The record quotes the vendor: the product has been end of life for 15 years, since 2009, and TRENDnet is "not able to replicate or fix any vulnerabilities". Plan around that, not around a patch.
How to check if you're exposed
There is no package manager here, so this is an inventory exercise.
- Search your asset list, purchase records and network scans for the model name TEW-432BRP.
- Check the label on the device or its admin page for the model and firmware revision. The record covers 3.10B20.
- Check whether the web admin interface is reachable from anywhere other than a trusted management network, in particular from the internet.
If you find one, assume it is exposed until you have shown otherwise.
What to do now
- Replace the router with a supported model. The vendor has said it will not fix this class of problem on an end of life product.
- Until it is gone, do not expose the web admin interface to the internet and limit it to one trusted management host.
- Change the administrator password and make sure it is not reused elsewhere, since exploitation needs a login (the vector lists low privileges).
- Put the device on its own network segment so a compromise cannot reach file servers or workstations.
- Record the device in your risk register with a retirement date.
Why it matters
The affected function is formSetRoute, and the record says a manipulated route field (ip, mask or gateway) leads to command injection. The classes are CWE-74 (injection of special elements into a downstream interpreter) and CWE-77 (command injection).
The score is moderate because the vector needs a low privilege login. That is cold comfort on a consumer router with a default or weak password. The record also notes that an exploit has been disclosed publicly and may be used. It does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
This is one of a group of flaws published on the same day for the same device. The honest summary for all of them is the same: retire the hardware.
Quick check
Can I mitigate this with a firmware update?
The record quotes the vendor saying it cannot replicate or fix vulnerabilities on this end of life product. Check the vendor's support page in case that changes, but plan on replacement.
Sources
Last reviewed: 19 October 2026.
