The vulnerability resides in the formWlanSetup function of the /goform/ endpoint on TRENDnet TEW‑432BRP. An attacker can provide a crafted enrollee parameter that bypasses input validation, resulting in shell command injection (CWE‑77). The flaw also reflects improper sanitization of user input (CWE‑74). Because the router’s web management interface is reachable from the network, an attacker can exploit the issue remotely without authentication.

The device model affected is TRENDnet TEW‑432BRP running firmware 3.10B20. The product was released in 2009 and has been End‑of‑Life for 15 years. No patches or security updates are available from the vendor, so the device remains vulnerable if it continues to expose the web interface. No newer TRENDnet models or firmware versions are reported as impacted.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalogue. Exploitation is possible by sending a malicious HTTP POST request to /goform/formWlanSetup with a crafted enrollee payload. If successful, the injected commands execute on the device, potentially compromising the router and the network it serves. Because the vendor has not released a fix and the product is no longer supported, the vulnerability remains present until the device is replaced or its exposure is eliminated.