PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10178 Dlink CVE debrief

CVE-2016-10178 is a critical D-Link DWR-932B router issue in which the HELODBG service on UDP port 39889 triggers "/sbin/telnetd -l /bin/sh". NVD rates the issue CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), consistent with a network-reachable path to device compromise or shell exposure.

Vendor
Dlink
Product
CVE-2016-10178
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Security teams responsible for D-Link DWR-932B routers, especially Internet-facing or remotely managed devices, should treat this as urgent. IoT, network, and edge-device operators should also care because the issue is reachable over UDP and requires no privileges or user interaction per the CVSS vector.

Technical summary

The NVD record marks the DWR-932B firmware CPE cpe:2.3:o:dlink:dwr-932b_firmware:02.02eu:revb as vulnerable and assigns CWE-254. The linked technical advisory describes HELODBG on UDP 39889 launching a telnetd process with "/bin/sh", while the CVSS vector indicates network access with no privileges or user interaction required.

Defensive priority

Immediate. Treat as an urgent exposure on any affected DWR-932B deployment, particularly if the device is reachable from untrusted networks.

Recommended defensive actions

  • Identify all D-Link DWR-932B deployments and confirm whether they match the vulnerable firmware CPE listed by NVD.
  • Block or restrict UDP 39889 at network boundaries and on any upstream controls that can prevent external reachability.
  • Remove affected devices from direct Internet exposure and place them behind segmentation or access controls.
  • Apply vendor remediation if available; if no supported fix exists, plan replacement or retirement of the device.
  • Monitor for unexpected telnet service exposure or other signs that debug services are reachable on the router.

Evidence notes

This debrief is based on the supplied NVD record and linked references only. The record was published on 2017-01-30 and last modified on 2026-05-13. NVD lists CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, identifies a vulnerable D-Link DWR-932B firmware CPE, and references both SecurityFocus BID 95877 and a third-party technical advisory describing the HELODBG-to-telnetd behavior.

Official resources

CVE-2016-10178 was published in the official record on 2017-01-30 and last modified on 2026-05-13. The source corpus ties the issue to third-party advisory material and the NVD entry rather than a vendor-authored fix notice.