Skip to main content

D-Link fixes serious security flaws that could have left your business wide open to attack

Web Hosting & Remote IT Support

D-Link has released patches for two critical vulnerabilities found in its network management suite which could allow threat actors to bypass authentication and execute arbitrary code, remotely. 

The company fixed two flaws found in D-View, its network management suite that various businesses use for general network management and administration.

The flaws were discovered late last year by security researchers taking part in Trend Micro’s Zero Day Initiative (ZDI). During the event, researchers found multiple vulnerabilities, with two standing out: CVE-2023-32165, and CVE-2023-32169. The former is a remote code execution flaw, which could be used to run malicious code with SYSTEM privileges. The latter, on the other hand, is an authentication bypass vulnerability that allows for the escalation of privilege, unauthorized access of information, and in some cases, installation of malware. 

Beta patch

Both flaws carry a severity score of 9.8 (critical). The issue affects D-View 8 version 2.9.1.27 and older. D-Link released the patch roughly two weeks ago, and is now urging users to apply it as soon as possible.

"As soon as D-Link was made aware of the reported security issues, we had promptly started our investigation and began developing security patches," the company said in a security advisory. The vendor also warned users that the patch is actually “beta software or hot-fix release”, meaning additional changes might occur in the future. It also means that the D-View might be unstable, or crash, after the introduction of the patch. 

The vendor also told users to verify the hardware revision of their endpoints, by inspecting the underside label or the web configuration panel, so that they don’t download the wrong firmware update. 

The full list of the discovered vulnerabilities is as follows:

Read more

> This venerable security vulnerability has exposed millions of routers to attack

 > Pretty much all Wi-Fi routers are vulnerable to attack, study finds

 > These are the best ID theft protection tools right now

  • ZDI-CAN-19496: D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability
  • ZDI-CAN-19497: D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
  • ZDI-CAN-19527: D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability
  • ZDI-CAN-19529: D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
  • ZDI-CAN-19534: D-Link D-View showUser Improper Authorization Privilege Escalation ZDI-CAN-19659: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

Via: BleepingComputer



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials
Computing Handbook - $9.95

Popular posts from this blog

Microsoft, Google, and Meta have borrowed EV tech for the next big thing in data centers: 1MW watercooled racks

Web Hosting & Remote IT Support Liquid cooling isn't optional anymore, it's the only way to survive AI's thermal onslaught The jump to 400VDC borrows heavily from electric vehicle supply chains and design logic Google’s TPU supercomputers now run at gigawatt scale with 99.999% uptime As demand for artificial intelligence workloads intensifies, the physical infrastructure of data centers is undergoing rapid and radical transformation. The likes of Google, Microsoft, and Meta are now drawing on technologies initially developed for electric vehicles (EVs), particularly 400VDC systems, to address the dual challenges of high-density power delivery and thermal management. The emerging vision is of data center racks capable of delivering up to 1 megawatt of power, paired with liquid cooling systems engineered to manage the resulting heat. Borrowing EV technology for data center evolution The shift to 400VDC power distribution marks a decisive break from legacy sy...
Post a Comment
Read more

When might Captain America: Brave New World be available to stream on Disney Plus?

Web Hosting & Remote IT Support Captain America: Brave New World has landed in theaters worldwide and I bet you're already wondering when it might debut on Disney Plus . Indeed, Marvel's latest movie has just taken flight in cinemas as of today (February 14), but, if you're not planning to watch it on the biggest screen possible, you'll want to know when it could come to Disney's primary streaming service. Right now, I can't tell you when it'll be released on one of the world's best streaming services . However, I can use some of its predecessors' Disney Plus launch dates to predict its arrival. Before you continue scrolling, though, read my Captain America: Brave New World review to see if it's worth watching, plus my Captain America: Brave New World hub and Captain America 4 cast and character guide for details on its cast, story, trailers, and more. When do we think Captain America 4 will debut on Disney Plus? You won...
Post a Comment
Read more