CVE-2016-10372
📋 TL;DR
The Eir D1000 modem has a critical vulnerability in its TR-064 protocol implementation that allows remote attackers to execute arbitrary commands without authentication. Attackers can exploit this via TCP port 7547 to gain full control of the device, potentially compromising the entire network. This affects all users of the Eir D1000 modem with default or vulnerable configurations.
💻 Affected Systems
- Eir D1000 modem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the modem allowing attackers to reconfigure the device, intercept all network traffic, install malware, and pivot to internal network devices.
Likely Case
Attackers gain administrative access to the modem, change DNS settings to redirect traffic, steal credentials, and potentially compromise connected devices.
If Mitigated
Limited to denial of service or temporary disruption if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Exploitation is straightforward using publicly available scripts. Attackers can chain multiple steps: open WAN port 80, retrieve credentials via TR-064, then execute arbitrary commands using the NewNTPServer feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates from Eir/ISP
Vendor Advisory: Contact Eir or your ISP for specific advisory
Restart Required: Yes
Instructions:
1. Contact your ISP (Eir) for firmware updates. 2. Apply the latest firmware patch. 3. Reboot the modem. 4. Change all default passwords including Wi-Fi and administrative credentials.
🔧 Temporary Workarounds
Block TR-064 port externally
linuxBlock incoming connections to TCP port 7547 on the WAN interface
iptables -A INPUT -p tcp --dport 7547 -j DROP
Disable TR-064 protocol
allDisable the TR-064 protocol if not required for ISP management
🧯 If You Can't Patch
- Replace the vulnerable modem with a different model
- Place the modem behind a firewall that blocks all incoming WAN connections except essential services
🔍 How to Verify
Check if Vulnerable:
Check if TCP port 7547 is open and accessible from the internet using nmap: nmap -p 7547 [public_ip]Check Version:
Check firmware version via modem web interface at http://192.168.1.1 or via ISP management portalVerify Fix Applied:
Verify port 7547 is no longer accessible from the internet and test if TR-064 commands are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual TR-064 protocol activity
- Multiple failed authentication attempts on port 7547
- Changes to NTP server settings
Network Indicators:
- External connections to internal port 7547
- Unusual outbound traffic from modem
- DNS changes from modem
SIEM Query:
source_port=7547 OR dest_port=7547 AND (action=deny OR protocol=TR-064)🔗 References
- https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/
- https://ghostbin.com/paste/q2vq2
- https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/
- https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/
- https://ghostbin.com/paste/q2vq2
- https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/
