CVE-2017-14429
CriticalSummary
The DHCP client on D-Link DIR-850L REV. A and REV. B devices allows unauthenticated remote code execution as root due to mishandling of shell metacharacters in /etc/services/INET/inet_ipv4.php.
Risk Assessment
Exploitation of this vulnerability could lead to full device compromise, posing a serious threat to the organization's network security.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to monitor devices for potential attacks.
Original NVD description (English source)
The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters, affecting generated files such as WAN-1-udhcpc.sh.