CVE-2016-10183
HighSummary
An issue was discovered on the D-Link DWR-932B router, allowing directory listing via ../ traversal in the qmiweb interface.
Risk Assessment
An attacker could gain access to sensitive files and information on the router, potentially leading to further attacks on the network.
Recommendation
It is recommended to update the router's firmware to the latest version and to block access to the qmiweb interface from untrusted sources.
Other vulnerabilities in D-Link DWR-932B router
See all- CVE-2016-10186High
An issue was discovered on the D-Link DWR-932B router related to the lack of deny rules in the /var/miniupnpd.conf file.
- CVE-2016-10185High
An issue was discovered on the D-Link DWR-932B router, where a secure_mode=no line exists in /var/miniupnpd.conf.
- CVE-2016-10184High
An issue was discovered on the D-Link DWR-932B router, allowing file reading via ..%2f traversal in qmiweb.
- CVE-2016-10181High
An issue was discovered on the D-Link DWR-932B router, where qmiweb provides sensitive information in response to CfgType=get_homeCfg requests.
- CVE-2016-10179High
An issue was discovered on the D-Link DWR-932B router related to a hardcoded WPS PIN of 28296607.
- CVE-2016-10182Critical
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
- CVE-2016-10178Critical
An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).
- CVE-2016-10177Critical
An issue was discovered on the D-Link DWR-932B router related to undocumented TELNET and SSH services that allow logins as admin with the password 'admin' and as root with the password '1234'.
Original NVD description (English source)
An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.