PT-2016-3182 · Eir · Eir D1000

Kenzo · Publicado 2016-10-07 · Atualizado 2024-07-21 · CVE-2016-10372

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eir D1000 modem (affected versions not specified)

Description The issue is related to the improper restriction of the TR-064 protocol, allowing remote attackers to execute arbitrary commands via TCP port 7547. This can be demonstrated by opening WAN access to TCP port 80, retrieving the login password, which defaults to the Wi-Fi password, and using the NewNTPServer feature.

Recommendations As a temporary workaround, consider restricting access to the TR-064 protocol and TCP port 7547 to minimize the risk of exploitation. Avoid using the default Wi-Fi password as the login password until the issue is resolved. Consider disabling the NewNTPServer feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-02234

CVE-2016-10372

Produtos afetados

Eir D1000

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb · Exploit
• 🔥 https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763 · Exploit
• 🔥 https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked · Exploit
• https://bdu.fstec.ru/vul/2017-02234 · Nota de Segurança
• https://t.me/aptreports/2098 · Publicação no Telegram
• https://t.me/aptreports/11253 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-10372 · Nota de Segurança
• https://ghostbin.com/paste/q2vq2 · Nota