CVE-2017-14426
HighSummary
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/shadow file, which may lead to unauthorized access to user passwords.
Risk Assessment
Improper permissions may allow attackers to read user passwords, increasing the risk of account takeover and further attacks on the network.
Recommendation
It is recommended to update the firmware of the devices to the latest version and correct the permissions on the /var/etc/shadow file.
Other vulnerabilities in D-Link DIR-850L REV. A and REV. B devices
See all- CVE-2017-14425High
D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/hnapasswd file, which may lead to unauthorized access to credential data.
- CVE-2017-14424High
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have incorrect 0666 permissions for the /var/passwd file.
- CVE-2017-14422High
D-Link DIR-850L REV. A and REV. B devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, allowing remote attackers to defeat HTTPS cryptographic protection mechanisms.
Original NVD description (English source)
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /etc/shadow symlink target) permissions.