PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10182 Dlink CVE debrief

CVE-2016-10182 is a critical command-injection vulnerability in the D-Link DWR-932B router firmware. NVD states that qmiweb allows command injection using backtick characters, and the affected NVD CPE entry is DWR-932B firmware 02.02eu revb. The issue carries a 9.8 CVSS 3.1 score and is classified as CWE-77.

Vendor
Dlink
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Organizations and individuals operating D-Link DWR-932B routers, especially environments running firmware 02.02eu revb or managing exposed router administration interfaces.

Technical summary

NVD describes the flaw as command injection in qmiweb, triggered through backtick characters. The vulnerable configuration in the NVD data is cpe:2.3:o:dlink:dwr-932b_firmware:02.02eu:revb, while the hardware CPE entry is not marked vulnerable. NVD maps the weakness to CWE-77 and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable exploitation without privileges or user interaction and high impact if successfully exploited.

Defensive priority

Critical. The combination of network attack vector, no privileges, no user interaction, and high confidentiality/integrity/availability impact makes this a high-priority exposure for any affected deployment.

Recommended defensive actions

  • Identify whether any deployed D-Link DWR-932B devices are running firmware 02.02eu revb.
  • Apply vendor-provided firmware or remediation guidance if an updated, non-vulnerable release is available.
  • Restrict access to router management and other exposed interfaces to trusted networks only.
  • Segment affected devices so they are not directly reachable from untrusted networks.
  • If remediation is not available, replace the affected device or remove it from service.
  • Validate exposure using the official NVD and CVE record references before and after remediation.

Evidence notes

Primary evidence comes from the NVD record for CVE-2016-10182, which lists the vulnerability as command injection in qmiweb, maps it to CWE-77, assigns CVSS 3.1 9.8/CRITICAL, and identifies the vulnerable CPE as D-Link DWR-932B firmware 02.02eu revb. The CVE record and NVD detail are official references; the third-party advisory link is included in the source corpus as supporting technical context.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10182 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10182

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10182 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10182

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.