CVE-2016-10372

published 2017-05-16

CVE-2016-10372: The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as…

Priority P1 92 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.

Detection & IOCs extracted from sources · hover to see the quote

port TCP/7547↗

port TCP/80↗

command NewNTPServer↗

path modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb↗

• → Monitor for inbound TR-064 SOAP requests on TCP port 7547, specifically those containing the 'NewNTPServer' parameter, which is the injection vector for this CVE. ↗
• → Alert on unauthenticated TR-064 SOAP requests to TCP/7547 from WAN-side (external) IP addresses targeting Zyxel/Eir D1000 modems. ↗
• → Detect attempts to open WAN access to TCP port 80 via TR-064 commands, which may indicate an attacker staging further access after initial exploitation. ↗

• · The exploit was tested on specific firmware versions; detection and patching efforts should prioritize devices running firmware up to and including the stated version. ↗
• · The default login password on affected devices equals the Wi-Fi password, meaning successful exploitation of this CVE can directly expose Wi-Fi credentials. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264