vulnwire
9.8crit

CVE-2016-10372in critical feed

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP por…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
81.9%
percentile 100%
Public exploits
0
none known

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.

Exploit prediction (EPSS)

81.90% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • devicereversing.wordpress.com /2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/ · x_refsource_MISC, x_transferred
  • isc.sans.edu /forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/ · x_refsource_MISC, x_transferred
  • ghostbin.com /paste/q2vq2 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.