CVE-2026-10061 is a medium (CVSS 6.3) command injection in the WPS page of the TRENDnet TEW-432BRP router, firmware 3.10B20. TRENDnet says the product has been end of life since 2009 and will not be fixed. Treat it as unpatchable: replace the router, and keep its admin interface off untrusted networks until then.
What's affected
The record names the TRENDnet TEW-432BRP wireless router, firmware 3.10B20, and the /goform/formWPS handler in its web interface. Other firmware revisions are not mentioned in the record.
There is no fixed version. The record quotes the vendor: the product has been end of life for 15 years, since 2009, and TRENDnet is "not able to replicate or fix any vulnerabilities". Plan around that, not around a patch.
How to check if you're exposed
There is no package manager here, so this is an inventory exercise.
- Search your asset list, purchase records and network scans for the model name TEW-432BRP.
- Check the label on the device or its admin page for the model and firmware revision. The record covers 3.10B20.
- Check whether the web admin interface is reachable from anywhere other than a trusted management network, in particular from the internet.
If you find one, assume it is exposed until you have shown otherwise.
What to do now
- Replace the router with a supported model. The vendor has said it will not fix this class of problem on an end of life product.
- Until it is gone, do not expose the web admin interface to the internet and limit it to one trusted management host.
- Change the administrator password and make sure it is not reused elsewhere, since exploitation needs a login (the vector lists low privileges).
- Put the device on its own network segment so a compromise cannot reach file servers or workstations.
- Record the device in your risk register with a retirement date.
Why it matters
The affected function is formWPS, and the record names the peerPin argument as the one that is not handled safely. The weakness classes are CWE-74 and CWE-77, both about untrusted input reaching a command interpreter.
Exploitation needs a low privilege login, which is why the score stays at 6.3. The record says an exploit is public. It does not say the flaw is being used in attacks, and it is not on the KEV list.
If you do keep the device a little longer, check whether Wi-Fi Protected Setup can be turned off in its admin interface. That is a sensible hardening step in general, though the record does not promise it blocks this issue.
Quick check
Is this the same bug as CVE-2026-10060?
No. It sits in a different handler (the WPS form rather than the route form) and has its own CVE. Both affect the same end of life router and have the same practical answer.
Sources
Last reviewed: 19 October 2026.
