CVE-2016-10372

Think of this modem as having a hidden maintenance door on the internet-facing side that was left unlocked. Anyone who finds it can walk in, grab the password, and take full control of the device — turning it into a tool for their own purposes, like a soldier in a botnet army, without you ever logging in or clicking anything.

This matters to you if you use an Eir D1000 modem or router, commonly provided as home/small-business broadband equipment. It's a risk specifically because the management port is exposed to the internet by default — no attacker login or user action is needed to exploit it.

Attackers are already exploiting this flaw in the wild, using it to install the 'Cling' botnet malware on vulnerable devices — this is confirmed, ongoing abuse, not a theoretical risk. Treat any exposed Eir D1000 as compromised or about to be, and cut its internet-facing management access today.

1. Identify any Eir D1000 devices in your environment and verify whether TCP port 7547 (TR-064/CWMP) and port 80 are reachable from the WAN side — use an external port scan or ask your ISP. 2. As an immediate mitigation, block inbound WAN access to TCP 7547 and 80 at the ISP/CPE firewall; this is the only concrete remediation surfaced in current findings since no confirmed patched firmware version is documented. 3. Contact Eir/the device vendor for firmware guidance — vendor advisories at the time recommended third-party perimeter protection (e.g., ISP-side filtering) pending an official fix. 4. Where possible, replace the device with a modem/router not affected by this TR-064 exposure. 5. Monitor for signs of compromise: unexpected NTP server changes, unusual outbound traffic, or device behavior consistent with botnet participation (e.g., Mirai-family/Cling activity). 6. Not currently in the CISA KEV catalog, so there is no federal remediation deadline, but public exploit code (2 known PoCs) and sustained press attention around active exploitation mean this should be prioritized as if it were.

CVSS 9.8 (Critical) — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity and availability (CWE-264, improper access control). The TR-064 management protocol is exposed on TCP 7547/80 by default; an attacker retrieves the admin credential (which defaults to the Wi-Fi password) and abuses the NewNTPServer parameter to achieve command execution. Exploitation is confirmed in the wild via news reporting (deployment of the 'Cling' botnet), and two public exploits exist, placing this well past PoC into active weaponization — EPSS scoring (falling trend) is superseded by this confirmed exploitation. Not listed in CISA KEV. No vendor-confirmed patched firmware version is available in current findings; mitigation relies on network-level filtering of the exposed management ports.