CVE-2023-5148mediumexplotación observadaCWE-434

CVE-2023-5148: fallo de gravedad media en D-Link DAR-7000

D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear DAR-7000+ Monitorear DAR-8000

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

47Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 6.3epss 31%
de la publicación al arma
Publicada en NVD25 sept
VulnCheck+316d
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240244. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
D-Link · DAR-7000D-Link · DAR-8000
CVEs relacionadas — D-Link DAR-7000

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-5151MEDIUMD-Link DAR-8000 autheditpwd.php sql injectionEPSS 80.6%CVE-2023-5145MEDIUMD-Link DAR-7000 licence.php unrestricted uploadEPSS 34.2%CVE-2023-5146MEDIUMD-Link DAR-7000/DAR-8000 updatelib.php unrestricted uploadEPSS 32.4%CVE-2023-5147MEDIUMD-Link DAR-7000 updateos.php unrestricted uploadEPSS 26.4%CVE-2023-5150MEDIUMD-Link DAR-7000/DAR-8000 web.php unrestricted uploadEPSS 22.7%CVE-2023-5149MEDIUMD-Link DAR-7000 userattestation.php unrestricted uploadEPSS 20.9%