CVE-2016-9496: Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pages

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-13 · updated 2026-06-17
Weakness: CWE-306

Description

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.

Affected products

Hughes Dw7000 Firmware: 6.9.0.34
Hughes Hn7000S Firmware: 6.9.0.34
Hughes Hn7000Sm Firmware: 6.9.0.34
Hughes Hn7740S Firmware: 6.9.0.34

References

https://www.kb.cert.org/vuls/id/614751
https://www.securityfocus.com/bid/96244
https://www.kb.cert.org/vuls/id/614751
https://www.securityfocus.com/bid/96244

Get alerted when CVE-2016-9496 or the next vulnerability affects your stack