Security readout for executives and security teams
Plain-English summary
CVE-2017-14428 is a weak file-permission issue in D-Link DIR-850L routers. On affected firmware, hostapd runtime files are writable by any local user or process on the device. This could help an attacker who already has device access tamper with wireless access-point behavior or chain the weakness with other router flaws.
Executive priority
Treat this as a medium-priority legacy router exposure unless the device is externally managed, shared, or already affected by other known flaws. The main business concern is unsupported network infrastructure that may accumulate chainable vulnerabilities.
Technical view
The CVE states D-Link DIR-850L Rev. A through FW114WWb07_h2ab_beta1 and Rev. B through FW208WWb02 set 0666 permissions on /var/run/hostapd* files. The source bundle does not provide CVSS, CWE, vendor fix details, or confirmed exploitation status.
Likely exposure
Exposure is limited to D-Link DIR-850L Rev. A and Rev. B devices running the listed affected firmware versions. Internet exposure alone is not enough evidence here; practical risk likely depends on local device access or chaining with another vulnerability.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not confirm active exploitation. The issue is best treated as a post-access or chained weakness affecting router control-plane integrity rather than a standalone remote compromise based on current evidence.
Researcher notes
Evidence is sparse: the CVE names affected revisions, firmware ranges, and world-writable hostapd files, but provides no CVSS, CWE, exploit confirmation, or vendor remediation detail in the supplied bundle. Avoid assuming remote exploitability without additional source evidence.
Mitigation direction
- Inventory D-Link DIR-850L Rev. A and Rev. B routers.
- Compare firmware versions against the affected version ranges.
- Check D-Link support guidance for fixed firmware or retirement advice.
- Replace unsupported affected routers if no maintained firmware is available.
- Restrict administrative access to trusted management networks only.
Validation and detection
- Confirm hardware revision from the router label or admin interface.
- Record installed firmware version for each DIR-850L device.
- On approved devices, verify /var/run/hostapd* file permissions if shell access exists.
- Review whether router management is reachable from untrusted networks.
- Track remediation status for every affected asset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14428 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.