CVE-2017-14419: dlink dir-850l_firmware Improper Certificate Validation
Vulnerability summary
CVE-2017-14419 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in dlink dir-850l_firmware. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 13-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices, participates in mydlink Cloud Services by establishing a TCP relay service for HTTP, even though a TCP relay service for HTTPS is also established.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.83% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (pierrekim.github.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Dlink1 product
- dir-850l_firmware< fw114wwb07_h2ab | fw114wwb07_h2ab:beta1 | ≤ fw208wwb02
1 vendor · 1 product
References
1 links- pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.htmlX Refsource MISCExploitThird Party Advisory