CVE-2023-5148mediumobserved exploitationCWE-434

CVE-2023-5148: medium-severity vulnerability in D-Link DAR-7000

D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload

Published · Updated

Follow this CVE+ Monitor DAR-7000+ Monitor DAR-8000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

47Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.3epss 31%
from disclosure to weapon
Published on NVDSep 25
VulnCheck+316d
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240244. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
D-Link · DAR-7000D-Link · DAR-8000
Related CVEs — D-Link DAR-7000

In the same product, most dangerous first.

CVE-2023-5151MEDIUMD-Link DAR-8000 autheditpwd.php sql injectionEPSS 80.6%CVE-2023-5145MEDIUMD-Link DAR-7000 licence.php unrestricted uploadEPSS 34.2%CVE-2023-5146MEDIUMD-Link DAR-7000/DAR-8000 updatelib.php unrestricted uploadEPSS 32.4%CVE-2023-5147MEDIUMD-Link DAR-7000 updateos.php unrestricted uploadEPSS 26.4%CVE-2023-5150MEDIUMD-Link DAR-7000/DAR-8000 web.php unrestricted uploadEPSS 22.7%CVE-2023-5149MEDIUMD-Link DAR-7000 userattestation.php unrestricted uploadEPSS 20.9%