CVE-2023-32164: D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability
D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the TftpSendFileThread class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19496.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32164?
CVE-2023-32164 is classified as a critical vulnerability due to its potential for information disclosure without authentication.
How do I fix CVE-2023-32164?
To fix CVE-2023-32164, update to the latest patched version of D-Link D-View that addresses this vulnerability.
What type of attack can be executed with CVE-2023-32164?
CVE-2023-32164 can be exploited by remote attackers to execute a directory traversal attack and disclose sensitive information.
Is authentication required to exploit CVE-2023-32164?
No, authentication is not required to exploit CVE-2023-32164, making it particularly dangerous.
Which software is affected by CVE-2023-32164?
CVE-2023-32164 affects D-Link D-View installations.