CVE-2016-10372

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-05-16 · updated 2026-06-17
Weakness: CWE-264

Description

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.

Affected products

Eir D1000 Modem Firmware: all versions

References

https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/
https://ghostbin.com/paste/q2vq2
https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/
https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/
https://ghostbin.com/paste/q2vq2
https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/

Get alerted when CVE-2016-10372 or the next vulnerability affects your stack