CVE-2023-32167: medium-severity vulnerability in D-Link D-View
D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
35Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 75%
D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. This vulnerability allows remote attackers to create and delete arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadMib function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create or delete files in the context of SYSTEM.
. Was ZDI-CAN-19529.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
D-Link · D-ViewRelated CVEs — D-Link D-View
In the same product, most dangerous first.
CVE-2023-32164HIGHD-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityEPSS 84.9%CVE-2023-44412HIGHD-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityEPSS 82.3%CVE-2023-32166HIGHD-Link D-View uploadFile Directory Traversal Arbitrary File Creation VulnerabilityEPSS 74.3%CVE-2023-32165CRITICALD-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution VulnerabilityEPSS 73.3%CVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.9%