CVE-2016-10180
published 2017-01-30CVE-2016-10180: An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
4.41%
90.2th percentile
An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dwr-932b_firmware | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
D-Link DWR-932B WPS PIN Generator weak prng (BID-95877)
vuldb·2026-05-16·CVSS 7.5
CVE-2016-10180 [HIGH] D-Link DWR-932B WPS PIN Generator weak prng (BID-95877)
A vulnerability has been found in D-Link DWR-932B and classified as critical. The affected element is an unknown function of the component WPS PIN Generator. Performing a manipulation results in cryptographically weak prng.
This vulnerability is reported as CVE-2016-10180. The attack is possible to be carried out remotely. No exploit exists.
GHSA
GHSA-8vx9-59h6-x23v: An issue was discovered on the D-Link DWR-932B router
ghsa_unreviewed·2022-05-13
CVE-2016-10180 [HIGH] CWE-1241 GHSA-8vx9-59h6-x23v: An issue was discovered on the D-Link DWR-932B router
An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Predictable Seed in Pseudo-Random Number Generator (PRNG)
mitre_cwe·CVSS 7.5
[HIGH] CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.
Modes of Introduction:
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Common Consequences:
Scope: Other. Impact: Varies by Context.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or b
CWE
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
mitre_cwe
CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
PRNGs are deterministic and, while their output appears
random, they cannot actually create entropy. They rely on
cryptographically secure and unique seeds for entropy so
proper seeding is critical to the secure operation of the
PRNG. Management of seeds could be broken down into two main areas: (1) protecting seeds as cryptographic material (such as a cryptographic key); (2) whenever possible, using a uniquely generated seed from
a cryptographically secure source PRNGs require a seed as input to generate a stream of
numbers that are functionally indistinguishable from
random numbers. While the output is, in many cases,
s
2017-01-30
Published