Skip to main content
Mallory
CriticalPublic exploit

Unauthenticated TR-064 Command Execution in Eir D1000 modem

IdentifiersCVE-2016-10372CWE-306

CVE-2016-10372 affects the Eir D1000 modem. The device does not properly restrict exposure and access to the TR-064 management protocol on TCP port 7547, allowing remote attackers to interact with management functionality from the WAN side. According to the provided content, an attacker can remotely open WAN access to TCP port 80, retrieve the device login password—which by default is the Wi-Fi password—and abuse the NewNTPServer feature to execute arbitrary commands. In practice, this is an unauthenticated remote management exposure issue that enables command execution through improperly protected TR-064 functionality.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker on the Internet to execute arbitrary commands on the affected modem without prior authorized access. The attacker can reconfigure the device, expose additional management services to the WAN, recover credentials in default configurations, and establish broader remote administrative access. This can lead to full compromise of the modem, use of the device in botnets, persistent unauthorized control, traffic manipulation, and follow-on attacks against the local network behind the router.

Mitigation

If you can’t patch tonight, do this now.

Until patched, block inbound access from untrusted networks to TCP port 7547 and any externally exposed management ports at the ISP, upstream firewall, or local perimeter. Disable remote administration and TR-064/TR-069-related exposure where possible. Restrict management access to trusted internal networks only, rotate administrative and Wi-Fi credentials, and audit devices for unauthorized configuration changes such as WAN exposure of TCP port 80 or altered NTP settings. Replace unsupported devices that cannot be secured.

Remediation

Patch, then assume compromise.

Apply vendor-provided firmware updates or patches that properly restrict TR-064 access and prevent WAN-side exposure of the management interface on TCP port 7547. Ensure the device is updated to a fixed firmware version if one is available from the vendor or ISP. Review device configuration to confirm that remote management and TR-064 services are not exposed externally, and change any default or derived credentials, including cases where the administrative password defaults to the Wi-Fi password.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
EirD1000 Modem Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.