Skip to main content

D-Link fixes serious security flaws that could have left your business wide open to attack

Web Hosting & Remote IT Support

D-Link has released patches for two critical vulnerabilities found in its network management suite which could allow threat actors to bypass authentication and execute arbitrary code, remotely. 

The company fixed two flaws found in D-View, its network management suite that various businesses use for general network management and administration.

The flaws were discovered late last year by security researchers taking part in Trend Micro’s Zero Day Initiative (ZDI). During the event, researchers found multiple vulnerabilities, with two standing out: CVE-2023-32165, and CVE-2023-32169. The former is a remote code execution flaw, which could be used to run malicious code with SYSTEM privileges. The latter, on the other hand, is an authentication bypass vulnerability that allows for the escalation of privilege, unauthorized access of information, and in some cases, installation of malware. 

Beta patch

Both flaws carry a severity score of 9.8 (critical). The issue affects D-View 8 version 2.9.1.27 and older. D-Link released the patch roughly two weeks ago, and is now urging users to apply it as soon as possible.

"As soon as D-Link was made aware of the reported security issues, we had promptly started our investigation and began developing security patches," the company said in a security advisory. The vendor also warned users that the patch is actually “beta software or hot-fix release”, meaning additional changes might occur in the future. It also means that the D-View might be unstable, or crash, after the introduction of the patch. 

The vendor also told users to verify the hardware revision of their endpoints, by inspecting the underside label or the web configuration panel, so that they don’t download the wrong firmware update. 

The full list of the discovered vulnerabilities is as follows:

Read more

> This venerable security vulnerability has exposed millions of routers to attack

 > Pretty much all Wi-Fi routers are vulnerable to attack, study finds

 > These are the best ID theft protection tools right now

  • ZDI-CAN-19496: D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability
  • ZDI-CAN-19497: D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
  • ZDI-CAN-19527: D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability
  • ZDI-CAN-19529: D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
  • ZDI-CAN-19534: D-Link D-View showUser Improper Authorization Privilege Escalation ZDI-CAN-19659: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

Via: BleepingComputer



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

Last orders! Breville’s Birthday Sale ends in 24 hours – save an extra 10% on already-discounted espresso machines with our exclusive code

Web Hosting & Remote IT Support It’s been a busy month for coffee machine maestro, Breville. Not only did it celebrate International Coffee Day at the start of the month, but this October is also the company’s birthday month. And to mark the occasion, you can save up to AU$550 on a range of top-performing espresso machines . And that’s not all, as you can save a further 10% on discounted models with our exclusive Breville coupon code . Alternatively, you can use our exclusive promo code sitewide on the complete range of Breville appliances. You’ll need to hurry though, as the Breville Birthday Sale comes to a close at 11:30pm AEDT 21 October. Breville is, of course, responsible for some of the best coffee machines in Australia , and as a result, it can make choosing the ideal model for your household a little bit trickier. To help guide you to cafe-quality coffee at home, I’ve picked out so...
Post a Comment
Read more

Mova V70 Ultra Complete review: a full-featured robovac let down by subpar performance

Web Hosting & Remote IT Support Mova V70 Ultra Complete: Two-minute review If you've never heard of Mova as a brand, you're not alone as it was initially only available in select European and South-East Asian countries. The brand, which is owned by Dreame Technology, is now expanding and is supposed to be value-focused side of the company — although you'd be hard pressed to believe that when its latest flagship robot vacuum costs upwards $1,000 / £1,000 / AU$3,000. However, the Mova V70 Ultra Complete brings everything you expect from such an expensive robovac, including some industry-first features that are now being adopted by other brands. This includes suction that's a whopping 42,000Pa at its maximum, as well as the impressively long reach of the side brush and mopping arm (12cm and 17cm respectively). I even love the fact that it eliminates the need for dust bags by us...
Post a Comment
Read more

UK small businesses are spending big on Anthropic — but OpenAI isn't far behind as expenditure on AI tools hits new high

Web Hosting & Remote IT Support An estimated 1 out of every 8 UK small and medium businesses are paying for AI tools Over 28% of SMEs are using two or more AI platforms Publishing is the main UK sector adopting AI British SMEs are moving toward AI solutions, with adoption increasing from 1.1% in 2023 to 12.8% in 2026, new research has claimed. The study , by small business credit card providers Capital on Tap, also shows that while smaller companies may have more modest budgets, they’re still happy to spread their bets when it comes to choosing an AI solution. Over 28% of SMEs are using multiple AI platforms – with Anthropic’s Claude just edging out OpenAI’s ChatGPT, with the average quarterly spend growing to a quarterly average of £75.60 per SME. SMEs explore AI Anthropic is the most popular AI provider among British SMEs according to the research, with those businesses devoting 54.1% of ...
Post a Comment
Read more