D-Link Dwr-932b Firmware vulnerabilities

10 CVEs affecting D-Link Dwr-932b Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-10186, published 2017-01-30.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-10182, published 2017-01-30. Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
• CVE-2016-10178, published 2017-01-30. Critical severity, CVSS 9.8. EPSS: 7.5% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. HELODBG on port 39889 (UDP) launches the "/sbin/telnetd -l /bin/sh" command.
• CVE-2016-10177, published 2017-01-30. Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin and root with the password 1234.
• CVE-2016-10184, published 2017-01-30. High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.
• CVE-2016-10183, published 2017-01-30. High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.
• CVE-2016-10179, published 2017-01-30. High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.
• CVE-2016-10180, published 2017-01-30. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
• CVE-2016-10186, published 2017-01-30. High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.
• CVE-2016-10185, published 2017-01-30. High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.
• CVE-2016-10181, published 2017-01-30. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests.