D-Link DIR-850L REV.
Priority LOW 35CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Why it matters now
EPSS 0.01288 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:* | before fw114wwb07_h2ab | Vulnerable | D-Link Japan K.K. |
| cpe:2.3:o:dlink:dir-850l_firmware:fw114wwb07_h2ab:beta1:*:*:*:*:*:* | fw114wwb07_h2ab beta1 | Vulnerable | D-Link Japan K.K. |
| cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:* | not specified by NVD | Running on | D-Link Japan K.K. |
| cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:* | up to fw208wwb02 | Vulnerable | D-Link Japan K.K. |
- cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:* Versions before fw114wwb07_h2ab Vulnerable ·D-Link Japan K.K.
- cpe:2.3:o:dlink:dir-850l_firmware:fw114wwb07_h2ab:beta1:*:*:*:*:*:* Versions fw114wwb07_h2ab beta1 Vulnerable ·D-Link Japan K.K.
- cpe:2.3:h:dlink:dir-850l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·D-Link Japan K.K.
- cpe:2.3:o:dlink:dir-850l_firmware:*:*:*:*:*:*:*:* Versions up to fw208wwb02 Vulnerable ·D-Link Japan K.K.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-14422
- 2026-10-03 Alias added: GHSA-vx8c-jjcf-h3vq
References
More D-Link Japan K.K. Dir-850l Firmware vulnerabilities
- TI-2017-10536 The DHCP client on D-Link DIR-850L REV. CVSS 3.1CRITICAL 9.8
- TI-2016-05627 D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action CVSS 3.0CRITICAL 9.8
- TI-2018-06551 An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band… CVSS 3.1CRITICAL 9.8
- TI-2021-21203 DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability… CVSS 3.1HIGH 7.5
- TI-2017-02398 Stack-based buffer overflow in D-Link DIR-850L and potentially others CVSS 3.1HIGH 8.8
- TI-2023-26714 An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-14422 · CVE Program
- CVE-2017-14422 · NVD
- FIRST EPSS
- GHSA-vx8c-jjcf-h3vq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences