CVE-2016-10184
HighSummary
An issue was discovered on the D-Link DWR-932B router, allowing file reading via ..%2f traversal in qmiweb.
Risk Assessment
An attacker could gain access to sensitive files on the router, potentially leading to data exposure or device compromise.
Recommendation
It is recommended to update the router's firmware to the latest version and restrict access to the management interface.
Other vulnerabilities in D-Link DWR-932B router
See all- CVE-2016-10186High
An issue was discovered on the D-Link DWR-932B router related to the lack of deny rules in the /var/miniupnpd.conf file.
- CVE-2016-10185High
An issue was discovered on the D-Link DWR-932B router, where a secure_mode=no line exists in /var/miniupnpd.conf.
- CVE-2016-10183High
An issue was discovered on the D-Link DWR-932B router, allowing directory listing via ../ traversal in the qmiweb interface.
- CVE-2016-10181High
An issue was discovered on the D-Link DWR-932B router, where qmiweb provides sensitive information in response to CfgType=get_homeCfg requests.
- CVE-2016-10179High
An issue was discovered on the D-Link DWR-932B router related to a hardcoded WPS PIN of 28296607.
- CVE-2016-10182Critical
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
- CVE-2016-10178Critical
An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).
- CVE-2016-10177Critical
An issue was discovered on the D-Link DWR-932B router related to undocumented TELNET and SSH services that allow logins as admin with the password 'admin' and as root with the password '1234'.
Original NVD description (English source)
An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.