CVE-2017-14422

published 2017-09-13

CVE-2017-14422: D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms by leveraging knowledge of this key from another installation.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-850l_firmware	< fw114wwb07_h2ab	fw114wwb07_h2ab
dlink	dir-850l_firmware	<= fw208wwb02	—
dlink	dir-850l_firmware	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798