CVE-2017-14425
HighSummary
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/hnapasswd file, which may lead to unauthorized access to credential data.
Risk Assessment
Improper permissions may allow attackers to access sensitive information, increasing the risk of device takeover.
Recommendation
It is recommended to update the firmware to the latest version and change the permissions on the /var/etc/hnapasswd file to be more restrictive.
Other vulnerabilities in D-Link DIR-850L REV. A and REV. B devices
See all- CVE-2017-14426High
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/shadow file, which may lead to unauthorized access to user passwords.
- CVE-2017-14424High
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have incorrect 0666 permissions for the /var/passwd file.
- CVE-2017-14422High
D-Link DIR-850L REV. A and REV. B devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, allowing remote attackers to defeat HTTPS cryptographic protection mechanisms.
Original NVD description (English source)
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permissions.