CVE-2016-10372

The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.

• CWE-264

• https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/Exploit, Third Party Advisory
• https://ghostbin.com/paste/q2vq2
• https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/Exploit, Technical Description, Third Party Advisory
• https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/Exploit, Third Party Advisory
• https://ghostbin.com/paste/q2vq2
• https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/Exploit, Technical Description, Third Party Advisory

Published

May 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10367In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5…
• CVE-2016-10368Open redirect vulnerability in Opsview Monitor Pro (Prior to…
• CVE-2016-10369unixsocket.c in lxterminal through 0.3.0 insecurely uses /tm…
• CVE-2016-1037Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat…
• CVE-2016-10370An issue was discovered on OnePlus devices such as the 3T. T…
• CVE-2016-10371The TIFFWriteDirectoryTagCheckedRational function in tif_dir…
• CVE-2016-10373Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-10374perltidy through 20160302, as used by perlcritic, check-all-…5.5
• CVE-2016-10375Yodl before 3.07.01 has a Buffer Over-read in the queue_push…
• CVE-2016-10376Gajim through 0.16.7 unconditionally implements the "XEP-014…
• CVE-2016-10377In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause…
• CVE-2016-10378e107 2.1.1 allows SQL injection by remote authenticated admi…