Is CVE-2016-10186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10186 being exploited in the wild.

How severe is CVE-2016-10186?

High severity, with a CVSS score of 7.5, published 30 January 2017.

Which products and versions are affected?

D-Link DWR-932B firmware 02.02EU (Rev. B) and earlier.

Is there a fix for CVE-2016-10186?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-10186 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-10186?

Check whether you run Dlink Dwr-932b or Dlink Dwr-932b Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10186: D-Link DWR-932B missing deny rules in UPnP configuration

CVE-2016-10186 · Severity: high · CVSS 7.5 · Published 2017-01-30

The D-Link DWR-932B LTE router contains a configuration error in its UPnP service. This flaw allows unauthorized network traffic to bypass intended security restrictions because the device lacks rules to deny potentially malicious requests. An attacker could exploit this to manipulate network settings or gain unauthorized access to services behind the router.

Technologies: Dlink Dwr-932b, Dlink Dwr-932b Firmware. Vendors: Dlink.

Quick answers

Is CVE-2016-10186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10186 being exploited in the wild.
How severe is CVE-2016-10186?: High severity, with a CVSS score of 7.5, published 30 January 2017.
Which products and versions are affected?: D-Link DWR-932B firmware 02.02EU (Rev. B) and earlier.
Is there a fix for CVE-2016-10186?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-10186 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-10186?: Check whether you run Dlink Dwr-932b or Dlink Dwr-932b Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The D-Link DWR-932B router (specifically Revision B) contains a vulnerability in its UPnP implementation. The configuration file /var/miniupnpd.conf is missing 'deny' rules, which are typically used to restrict which devices or IP ranges can utilize UPnP to modify NAT/firewall rules. An attacker on the network can exploit this lack of access control to perform unauthorized port mapping or other UPnP-related actions. This issue is part of a larger set of vulnerabilities identified in this specific hardware revision, including hardcoded credentials and backdoors. No official patch was released as the vendor reportedly ceased support for this model revision.

Affected products

D-Link DWR-932B firmware 02.02EU (Rev. B) and earlier

Timeline

2016-09-28: disclosed: Initial public disclosure by security researcher Pierre Kim
2017-01-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.