CVE-2017-14429

CRITICAL

D-Link DIR-850L REV. A FW114WWb07 & REV. B FW208WWb02 - Unauthenticated RCE via DHCP Client

Title source: llm

Description

The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters, affecting generated files such as WAN-1-udhcpc.sh.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html

Scores

CVSS v3 9.8

EPSS 0.0427

EPSS Percentile 89.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-78

Status published

Products (2)

dlink/dir-850l_firmware fw114wwb07_h2ab beta1

dlink/dir-850l_firmware < fw114wwb07_h2ab

Published Sep 13, 2017

Tracked Since Feb 18, 2026