CVE-2023-32166: D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability
D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of SYSTEM. Was ZDI-CAN-19527.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32166?
CVE-2023-32166 is categorized as a high severity vulnerability due to its potential for arbitrary file creation on affected systems.
How do I fix CVE-2023-32166?
To mitigate CVE-2023-32166, users should apply the latest firmware updates provided by D-Link for the D-View product.
Who is affected by CVE-2023-32166?
CVE-2023-32166 affects installations of D-Link D-View that allow remote attackers to exploit the directory traversal flaw.
Is authentication required to exploit CVE-2023-32166?
Yes, authentication is required for attackers to exploit CVE-2023-32166.
What type of vulnerability is CVE-2023-32166?
CVE-2023-32166 is a directory traversal vulnerability that enables arbitrary file creation.