CVE-2016-10186
HighSummary
An issue was discovered on the D-Link DWR-932B router related to the lack of deny rules in the /var/miniupnpd.conf file.
Risk Assessment
The absence of proper security rules may lead to unauthorized access to UPnP services, posing a risk to network security.
Recommendation
It is recommended to add appropriate deny rules to the configuration file to restrict access to UPnP services.
Other vulnerabilities in D-Link DWR-932B router
See all- CVE-2016-10185High
An issue was discovered on the D-Link DWR-932B router, where a secure_mode=no line exists in /var/miniupnpd.conf.
- CVE-2016-10184High
An issue was discovered on the D-Link DWR-932B router, allowing file reading via ..%2f traversal in qmiweb.
- CVE-2016-10183High
An issue was discovered on the D-Link DWR-932B router, allowing directory listing via ../ traversal in the qmiweb interface.
- CVE-2016-10181High
An issue was discovered on the D-Link DWR-932B router, where qmiweb provides sensitive information in response to CfgType=get_homeCfg requests.
- CVE-2016-10179High
An issue was discovered on the D-Link DWR-932B router related to a hardcoded WPS PIN of 28296607.
- CVE-2016-10182Critical
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
- CVE-2016-10178Critical
An issue was discovered on the D-Link DWR-932B router that allows the command '/sbin/telnetd -l /bin/sh' to be executed by HELODBG on port 39889 (UDP).
- CVE-2016-10177Critical
An issue was discovered on the D-Link DWR-932B router related to undocumented TELNET and SSH services that allow logins as admin with the password 'admin' and as root with the password '1234'.
Original NVD description (English source)
An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.