CVE-2017-14422
HighSummary
D-Link DIR-850L REV. A and REV. B devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, allowing remote attackers to defeat HTTPS cryptographic protection mechanisms.
Risk Assessment
Exploitation of this vulnerability could lead to interception of data transmitted over HTTPS, posing a serious threat to information security within the organization.
Recommendation
It is recommended to update the firmware of the devices to the latest version that eliminates the use of the shared private key and to implement additional security measures.
Other vulnerabilities in D-Link DIR-850L REV. A and REV. B devices
See all- CVE-2017-14426High
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/shadow file, which may lead to unauthorized access to user passwords.
- CVE-2017-14425High
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/hnapasswd file, which may lead to unauthorized access to credential data.
- CVE-2017-14424High
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have incorrect 0666 permissions for the /var/passwd file.
Original NVD description (English source)
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms by leveraging knowledge of this key from another installation.