TRENDnet TEW-432BRP Command Injection Vulnerability in WPS Function

A command injection vulnerability has been identified in the TRENDnet TEW-432BRP router, specifically in version 3.10B20. The issue arises in the WPS form handling, where the 'peerPin' argument can be manipulated to execute arbitrary commands on the operating system. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/formWPS' with the 'peerPin' parameter set to a command, such as 'reboot'. The router will execute the command, demonstrating the command injection flaw.