Skip to main content

D-Link fixes serious security flaws that could have left your business wide open to attack

Web Hosting & Remote IT Support

D-Link has released patches for two critical vulnerabilities found in its network management suite which could allow threat actors to bypass authentication and execute arbitrary code, remotely. 

The company fixed two flaws found in D-View, its network management suite that various businesses use for general network management and administration.

The flaws were discovered late last year by security researchers taking part in Trend Micro’s Zero Day Initiative (ZDI). During the event, researchers found multiple vulnerabilities, with two standing out: CVE-2023-32165, and CVE-2023-32169. The former is a remote code execution flaw, which could be used to run malicious code with SYSTEM privileges. The latter, on the other hand, is an authentication bypass vulnerability that allows for the escalation of privilege, unauthorized access of information, and in some cases, installation of malware. 

Beta patch

Both flaws carry a severity score of 9.8 (critical). The issue affects D-View 8 version 2.9.1.27 and older. D-Link released the patch roughly two weeks ago, and is now urging users to apply it as soon as possible.

"As soon as D-Link was made aware of the reported security issues, we had promptly started our investigation and began developing security patches," the company said in a security advisory. The vendor also warned users that the patch is actually “beta software or hot-fix release”, meaning additional changes might occur in the future. It also means that the D-View might be unstable, or crash, after the introduction of the patch. 

The vendor also told users to verify the hardware revision of their endpoints, by inspecting the underside label or the web configuration panel, so that they don’t download the wrong firmware update. 

The full list of the discovered vulnerabilities is as follows:

Read more

> This venerable security vulnerability has exposed millions of routers to attack

 > Pretty much all Wi-Fi routers are vulnerable to attack, study finds

 > These are the best ID theft protection tools right now

  • ZDI-CAN-19496: D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability
  • ZDI-CAN-19497: D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
  • ZDI-CAN-19527: D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability
  • ZDI-CAN-19529: D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability
  • ZDI-CAN-19534: D-Link D-View showUser Improper Authorization Privilege Escalation ZDI-CAN-19659: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

Via: BleepingComputer



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

The Apple Watch ban is lifted, on appeal – but the reprieve might only be temporary

Web Hosting & Remote IT Support The Apple Watch ban story has developed quickly over the last week and a bit, and there's now a new twist: the US Court of Appeals is putting a pause on the US sales and import ban while it reviews the case, which means the Apple Watch 9 and Apple Watch Ultra 2 can go back on sale for the time being. "We are thrilled to return the full Apple Watch lineup to customers in time for the new year," an Apple spokesperson told TechRadar. "We are pleased the US Court of Appeals for the Federal Circuit has stayed the exclusion order while it considers our request to stay the order pending our full appeal." The watches in question are now once again available from "select" Apple Stores, and will also be going on sale from the Apple website from 12pm PT / 3pm ET on Thursday, December 28 (that's 8pm in the UK, and early on December 29 in Australia). All Apple Stores should have stock by the weekend. As for how long t...
Post a Comment
Read more

AI tools are making social engineering attacks even more convincing, and I fear that this is only the beginning

Web Hosting & Remote IT Support Nick Park’s Wallace and Gromit were brought crashing into the 21st century in December 2024 with their latest adventure, Vengeance Most Fowl . The film challenges our growing dependence on smart technology in the form of a robotic garden gnome, built by Wallace to support his gardening business, which is then hacked by the Kubrick-esque Feathers McGraw for his own nefarious purposes. One of the more interesting but less commented on parts of the film shows Gromit cautiously entering his house and being greeted by what he thinks is Wallace’s reassuring voice, only to be confronted with Feathers and the robotic gnome. Technology’s ability to mimic linguistic patterns, to clone a person’s voice and understand and respond to questions has developed dramatically in the last few years. This has not gone unnoticed by the world’s criminals and scammers, with the result that social engineering attacks are not only on the rise but are more sophisticated a...
Post a Comment
Read more