CVE-2023-44414

The vulnerability is located in the coreservice_action_script action, where an unsafe function is exposed (CWE-749 — Exposed Dangerous Method or Function). An attacker can invoke this function remotely, without any authentication, over the network. Successful exploitation of the vulnerability allows code execution in the context of the SYSTEM account, i.e., with the highest privileges in the Windows operating system.

An attacker gains the ability to execute arbitrary code with SYSTEM privileges, which means complete takeover of the attacked device or host running D-Link D-View. Violation of confidentiality, integrity and availability of the system is possible.

Apply patches available from the vendor according to the references. It is recommended to monitor official D-Link communications and Zero Day Initiative advisories (ZDI-23-1512). Until the patch is implemented, consider restricting network access to the D-View service only to trusted hosts through a firewall or network segmentation.

D-Link D-View 8 — versions indicated in the vendor references and ZDI advisories (ZDI-23-1512)