A command injection flaw was discovered in the formSetRoute functionality of TRENDnet TEW‑432BRP firmware 3.10B20. By crafting input for the ip/mask/gateway arguments, an attacker can cause arbitrary shell commands to be executed on the device’s operating system, enabling remote code execution that can compromise confidentiality, integrity, and availability of the network.

The flaw is limited to TRENDnet TEW‑432BRP routers running firmware version 3.10B20. The vendor has declared the device end‑of‑life since 2009, so no patch or update is available.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, suggesting the probability of exploitation is currently unknown. The exploit is remotely accessible through the web interface and the vendor’s lack of support means the vulnerability remains unpatched, increasing the risk that attackers can execute arbitrary commands via the formSetRoute endpoint. The likely attack vector is remote network access to the device’s HTTP interface.