CRITICAL🇵🇱 Wersja polska

CVE-2023-32165

CVSS 9.8v3.0pub. 2024-05-03upd. 2025-08-07

D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TftpReceiveFileHandler class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19497.

🤖 AI Analysis
How it works

The vulnerability is located in the TftpReceiveFileHandler class and results from insufficient validation of the user-supplied path before it is used in file operations (path traversal, CWE-22). An attacker can submit a crafted path that extends beyond the allowed directory, allowing placement of a malicious file anywhere on the system. As a result, code execution is possible in the context of the SYSTEM account.

Impact

An attacker can remotely execute arbitrary code with SYSTEM privileges, gaining full control over the compromised host, including the ability to install malicious software, steal data, and perform lateral movement within the network.

Mitigation & patch

Security patches available from the vendor should be applied according to references (D-Link Security Announcement SAP10332 available at supportannouncement.us.dlink.com). It is also recommended to restrict network access to the TFTP service only to trusted hosts and monitor network traffic for unexpected file transfers.

Who is affected

D-Link D-View 8 — versions indicated in vendor references (SAP10332)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink D View 8

    APP
    Dlink
    ≤ 2.0.1.27
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEPath Traversal
CWE
References

Related vulnerabilities

CVE-2024-5296CRITICAL9.8PL ✓ten sam produkt

D-Link D-View 8 — pominięcie uwierzytelnienia przez zakodowany klucz kryptograficzny

CVE-2023-44414CRITICAL9.8PL ✓ten sam produkt

D-Link D-View: RCE przez ujawnioną niebezpieczną funkcję w coreservice_action_script

CVE-2023-44411CRITICAL9.8PL ✓ten sam produkt

D-Link D-View: hardcoded credentials umożliwiają bypass uwierzytelnienia

CVE-2023-32169CRITICAL9.8PL ✓ten sam produkt

D-Link D-View: pominięcie uwierzytelnienia przez hardkodowany klucz kryptograficzny

CVE-2023-7163CRITICAL10.0PL ✓ten sam produkt

D-Link D-View 8: Manipulacja inwentarzem sond umożliwia RCE i DoS