#VU8210 Information disclosure in DIR-850L - CVE-2017-14424

Vulnerability identifier: #VU8210

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-14424

CWE-ID: CWE-255

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
DIR-850L
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: D-Link

Description
The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists due to storing of credentials in cleartext. A local attacker can view arbitrary file on the system.

Mitigation

Cybersecurity Help is currently unaware of any official patch addressing the vulnerability.

Vulnerable software versions

DIR-850L: Rev.B1 2.06 - 2.07.B05

---

External links
https://pierrekim.github.io/advisories/2017-dlink-0x00-dlink-850l-cloud.txt

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.