CVE-2017-14422
High
Description
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDlink Dir-850l Firmware
PublishedSep 13, 2017
First seenSep 13, 2017
How to fix
Update
- dlink dir-850l_firmwarefw114wwb07_h2ab or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dlink dir-850l_firmware | v < fw114wwb07_h2ab, fw114wwb07_h2ab, v ≤ fw208wwb02 | fw114wwb07_h2ab |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.