CVE-2017-14429 The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root becau...
CriticalCVSS 9.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters, affecting generated files such as WAN-1-udhcpc.sh.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dlink dir-850l firmware | < fw114wwb07_h2ab | fw114wwb07_h2ab |
| dlink dir-850l firmware | = fw114wwb07_h2ab-beta1 | No fix listed |
| dlink dir-850l firmware | <= fw208wwb02 | No fix listed |
References
- pierrekim.github.io exploit third-party-advisory