CVE-2016-10372
CRITICAL EXPLOITEDEir D1000 Modem Firmware - Remote Code Execution via TR-064 Protocol
Title source: llmExploitation Summary
CVE-2016-10372 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including Kenzo, including a Metasploit module exploits/linux/http/tr064_ntpserver_cmdinject.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Zyxel/Eir D1000 DSL modems via the TR-064 SOAP interface. It injects commands into the 'NewNTPServer' parameter, allowing remote code execution without authentication.
Description
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.
Exploits (1)
This Metasploit module exploits a command injection vulnerability in Zyxel/Eir D1000 DSL modems via the TR-064 SOAP interface. It injects commands into the 'NewNTPServer' parameter, allowing remote code execution without authentication.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H