CVE-2026-23754highCWE-639

CVE-2026-23754: falha de alta gravidade em D-Link D-View 8

D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar D-View

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
D-Link · D-View 8
CVEs relacionadas — D-Link D-View 8

No mesmo produto, das mais perigosas para as menos.

CVE-2023-5074CRITICALAuthentication Bypass in D-Link D-View 8EPSS 69.6%CVE-2023-7163CRITICALD-Link D-View 8 Unauthenticated Probe-Core Server CommunicationEPSS 1.7%CVE-2026-23755HIGHD-Link D-View 8 Installer DLL Preloading via Uncontrolled Search PathEPSS 0.2%