CVE-2023-32164
Published: 03 May 2024
Summary
CVE-2023-32164 is a high-severity Path Traversal (CWE-22) vulnerability in Dlink D-View 8. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-32164 is a directory traversal vulnerability in D-Link D-View that permits information disclosure. The flaw resides in the TftpSendFileThread class, where insufficient validation of a user-supplied path allows file operations to access arbitrary locations on affected installations. The issue carries a CVSS score of 7.5 and is tracked under CWE-22.
Remote attackers can exploit the vulnerability without authentication to read sensitive files in the context of the SYSTEM account. The attack requires only network access and leverages the TFTP-related thread to traverse directories and retrieve arbitrary data.
D-Link has published advisory SAP10332 and the Zero Day Initiative has released ZDI-23-715, both addressing the vulnerability and directing users to available updates or mitigations for D-View installations.
The associated EPSS score has remained in the moderate range with a current value of 0.3513 and a peak of 0.3868.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36432
Vulnerability details
D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TftpSendFileThread class. The…
more
issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19496.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.