D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability

The impact of CVE-2023-32165 is severe due to the ease of exploitation and the potential for complete system takeover. An attacker can leverage the vulnerability via the TftpReceiveFileHandler to upload and execute malicious code without requiring any authentication. This allows for arbitrary code execution in the SYSTEM context, granting the attacker full control over the affected D-View 8 instance. Successful exploitation could lead to data theft, system modification, denial of service, or the installation of persistent malware. The lack of authentication makes this vulnerability particularly concerning, as it significantly lowers the barrier to entry for attackers.

Organizations utilizing D-Link D-View 8 for network management, particularly those with internet-facing deployments or legacy configurations, are at significant risk. Shared hosting environments where multiple users share a D-View 8 instance are also vulnerable, as a compromise of one user could potentially impact others.

• windows / supply-chain:

Get-Process -Name DView | Select-Object -ExpandProperty Path

• linux / server:

ps aux | grep DView

• generic web:

curl -I http://<dview_ip>/TftpReceiveFileHandler

1. 2024-05-03Disclosure

   disclosure

1. 予約済み2023-05-03
2. 公開日2024-05-03
3. 更新日2024-09-18
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2023-32165 is to upgrade D-Link D-View 8 to a patched version as soon as possible. D-Link has not released a specific fixed version in the provided data. If immediate patching is not feasible, consider temporarily disabling the TFTP server functionality within D-View 8 to reduce the attack surface. Network segmentation and strict firewall rules can also help limit the potential impact by restricting access to the D-View 8 management interface. After upgrading, verify the fix by attempting to trigger the vulnerable TftpReceiveFileHandler functionality and confirming that the request is rejected.