D-Link DIR-850L up to FW114WWb07_h2ab_beta1/FW208WWb02 DHCP Client inet_ipv4.php command injection

Summaryinfo

A vulnerability described as critical has been identified in D-Link DIR-850L up to FW114WWb07_h2ab_beta1/FW208WWb02. Affected by this issue is some unknown functionality of the file /etc/services/INET/inet_ipv4.php of the component DHCP Client. Such manipulation leads to command injection. This vulnerability is referenced as CVE-2017-14429. It is possible to launch the attack remotely. No exploit is available. Restrictive firewalling should be applied.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in D-Link DIR-850L up to FW114WWb07_h2ab_beta1/FW208WWb02 (Router Operating System). Affected by this issue is an unknown code block of the file /etc/services/INET/inet_ipv4.php of the component DHCP Client. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters, affecting generated files such as WAN-1-udhcpc.sh.

The bug was discovered 09/08/2017. The weakness was published 09/13/2017 (Website). The advisory is shared for download at pierrekim.github.io. This vulnerability is handled as CVE-2017-14429 since 09/13/2017. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 05/06/2025). The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $5k-$25k. By approaching the search of inurl:etc/services/INET/inet_ipv4.php it is possible to find vulnerable targets with Google Hacking.

Addressing this vulnerability is possible by firewalling .

Similar entries are available at VDB-106564, VDB-106565, VDB-106566 and VDB-106567. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-850L

Version

• FW114WWb07_h2ab_beta1
• FW208WWb02

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion