CVE-2023-32165: fallo crítico en D-Link D-View
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
50Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 73%
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the TftpReceiveFileHandler class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19497.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
D-Link · D-ViewCVEs relacionadas — D-Link D-View
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-32164HIGHD-Link D-View TftpSendFileThread Directory Traversal Information Disclosure VulnerabilityEPSS 84.9%CVE-2023-44412HIGHD-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityEPSS 82.3%CVE-2023-32167MEDIUMD-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion VulnerabilityEPSS 74.9%CVE-2023-32166HIGHD-Link D-View uploadFile Directory Traversal Arbitrary File Creation VulnerabilityEPSS 74.3%CVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-44414CRITICALD-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 2.9%