Is CVE-2016-10185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10185 being exploited in the wild.

How severe is CVE-2016-10185?

High severity, with a CVSS score of 7.5, published 30 January 2017.

Which products and versions are affected?

D-Link DWR-932B firmware 02.02EU revB.

Is there a fix for CVE-2016-10185?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-10185 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-10185?

Check whether you run Dlink Dwr-932b or Dlink Dwr-932b Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10185: D-Link DWR-932B disabled UPnP security mode

CVE-2016-10185 · Severity: high · CVSS 7.5 · Published 2017-01-30

The D-Link DWR-932B LTE router contains a configuration error that disables security checks for the UPnP service. This service is typically used to allow devices on a network to automatically discover each other and open ports. Because security mode is disabled, an attacker could potentially manipulate network settings or redirect traffic without authorization, compromising the integrity of the local network.

Technologies: Dlink Dwr-932b, Dlink Dwr-932b Firmware. Vendors: Dlink.

Quick answers

Is CVE-2016-10185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10185 being exploited in the wild.
How severe is CVE-2016-10185?: High severity, with a CVSS score of 7.5, published 30 January 2017.
Which products and versions are affected?: D-Link DWR-932B firmware 02.02EU revB.
Is there a fix for CVE-2016-10185?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-10185 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-10185?: Check whether you run Dlink Dwr-932b or Dlink Dwr-932b Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An issue was discovered in the D-Link DWR-932B router where the UPnP daemon (miniupnpd) is configured with 'secure_mode=no' in /var/miniupnpd.conf. By default, UPnP 'secure mode' restricts UPnP forwarded ports to the IP address of the device requesting the mapping. With this security feature disabled, the router may allow UPnP requests to map ports to any internal IP address, potentially allowing a remote attacker to bypass firewall restrictions or perform unauthorized port forwarding. This vulnerability is part of a larger set of security issues identified in this device, including hardcoded credentials and backdoors.

Affected products

D-Link DWR-932B firmware 02.02EU revB

Timeline

2016-09-28: disclosed: Initial researcher disclosure by Pierre Kim
2017-01-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.