PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10185 Dlink CVE debrief

CVE-2016-10185 describes an insecure configuration on the D-Link DWR-932B router: a secure_mode=no line is present in /var/miniupnpd.conf. NVD classifies the issue as High severity with a CVSS 3.1 score of 7.5 and lists the affected firmware as 02.02eu revB. The public record and third-party advisory references point to a configuration weakness rather than a software memory-safety flaw.

Vendor
Dlink
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Administrators and owners of D-Link DWR-932B devices running the affected firmware should review their configuration, especially if miniupnpd or UPnP-related services are enabled or exposed on the device.

Technical summary

The NVD entry ties CVE-2016-10185 to a D-Link DWR-932B firmware image and notes that /var/miniupnpd.conf contains secure_mode=no. That setting indicates the service is configured without its secure mode enabled. NVD assigns CWE-254 and a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, reflecting that the issue is reachable over the network and can affect integrity.

Defensive priority

High for any exposed or actively used D-Link DWR-932B deployment, because the issue is network-reachable and scored High by NVD.

Recommended defensive actions

  • Confirm whether your D-Link DWR-932B device uses firmware 02.02eu revB or another affected build listed by NVD.
  • Review /var/miniupnpd.conf and verify whether secure_mode is set to an appropriate protected value.
  • If UPnP/miniupnpd is not required, disable the service or remove its exposure from untrusted networks.
  • If the device is internet-reachable, place it behind stronger network controls and restrict management access.
  • Check vendor and NVD guidance for any firmware update or corrective configuration available for this model.

Evidence notes

Source evidence is limited to the NVD CVE record, the CVE record page, and a third-party technical advisory referenced by MITRE/NVD. The NVD metadata identifies the vulnerable CPE as cpe:2.3:o:dlink:dwr-932b_firmware:02.02eu:revb and the weakness type as CWE-254. The published date supplied for the CVE is 2017-01-30T04:59:00.500Z; the later modified timestamp is metadata update information and not the vulnerability date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10185 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10185

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10185 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10185

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.