The vulnerability resides in the TRENDnet TEW-432BRP router firmware 3.10B20 in the formWPS handler of the /goform/formWPS endpoint. By controlling the peerPin argument, an attacker can inject arbitrary operating‑system commands into the router’s execution context. This affords remote attackers the ability to run arbitrary code on the device, potentially leading to full compromise of the network segment. The weakness is a classic command injection flaw outlined by CWE-77 and a malformed input handling flaw referred to as CWE-74.

The affected product is TRENDnet TEW-432BRP version 3.10B20. This unit is an end‑of‑life product, discontinued in 2009, and the vendor has made it clear that the device is no longer supported or patched.

The CVSS score of 5.3 indicates moderate severity, but the lack of a patch and the remote nature of the attack raise the practical risk. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalogue. An attacker can remotely access the device via the management interface, submit a crafted peerPin value, and trigger the injected command. Because the device is out of warranty and unmaintained, the likelihood of exploitation remains significant for networks still operating this hardware.