PT-2016-3182 · Eir · Eir D1000

Kenzo · Published 2016-10-07 · Updated 2024-07-21 · CVE-2016-10372

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eir D1000 modem (affected versions not specified)

Description The issue is related to the improper restriction of the TR-064 protocol, allowing remote attackers to execute arbitrary commands via TCP port 7547. This can be demonstrated by opening WAN access to TCP port 80, retrieving the login password, which defaults to the Wi-Fi password, and using the NewNTPServer feature.

Recommendations As a temporary workaround, consider restricting access to the TR-064 protocol and TCP port 7547 to minimize the risk of exploitation. Avoid using the default Wi-Fi password as the login password until the issue is resolved. Consider disabling the NewNTPServer feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-02234

CVE-2016-10372

Affected Products

Eir D1000

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb · Exploit
• 🔥 https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763 · Exploit
• 🔥 https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked · Exploit
• https://bdu.fstec.ru/vul/2017-02234 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10372 · Security Note
• https://t.me/aptreports/2098 · Telegram Post
• https://t.me/aptreports/11253 · Telegram Post
• https://ghostbin.com/paste/q2vq2 · Note