CVE-2016-10372: Eir D1000 modem TR-064 access control flaw allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and a very high EPSS score make this an urgent remote code execution risk.

What it is

The Eir D1000 modem does not properly restrict the TR-064 protocol, letting remote attackers reach it over TCP port 7547. By opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and abusing the NewNTPServer feature, an attacker can run arbitrary commands on the device.

Impact

An attacker gains arbitrary command execution on the modem, giving full control of the device and its network position. Because the default login password equals the Wi-Fi password, compromise can also expose the local wireless network.

Attack surface

Reachable remotely over the network via TCP port 7547 (TR-064) with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The described chain also involves WAN access to TCP port 80 and the NewNTPServer feature.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.81474, 99.6th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply vendor firmware updates for the Eir D1000 modem if available; if no fix exists, replace or isolate the device.
• Block inbound access to TCP port 7547 (and 80) from the WAN at the network edge.
• Change the default login password and ensure it is not the same as the Wi-Fi password.
• Disable remote/WAN management of the modem where the feature is not required.
• Segment or retire affected modems that cannot be patched.

Detection

• Monitor for inbound connections to TCP port 7547 and unexpected WAN access to TCP port 80 on modems.
• Alert on TR-064 SOAP requests invoking the NewNTPServer action.
• Watch for unexpected outbound traffic or command execution artifacts from modem management addresses.
• Audit modem login events and password changes for signs of default-credential use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.