D-View network management suite, developed by D-Link, has received a security update to patch two critical severity vulnerabilities. D-View can be used to control device configurations, monitor performance, and create network maps, as well as for other administrative network management tasks. These operations require access to devices and network components with high privileges so the effects of an exploit on these devices could potentially result in attackers gaining complete control over the network. Six vulnerabilities were reported to D-Link in December of 2022, two of which turned out to be critical severity flaws. A patch for all six of these vulnerabilities has now been released, along with a support announcement from D-Link. 

The first critical flaw patched in this recent update is tracked as CVE-2023-32165 and has been assigned a CVSS base score of 9.8. This vulnerability occurs within the TftpReceiveFileHandler as a result of improper validation of a user-supplied path. An unauthenticated attacker can exploit this directory traversal flaw to perform remote code execution with SYSTEM level privileges. The second critical vulnerability also received a CVSS base score of 9.8 and is tracked as CVE-2023-32169. This is due to a hard-coded cryptographic key within the TokenUtils being able to be used by a remote attacker. This results in the bypass of authentication on the vulnerable system, which can enable the attacker to potentially perform privilege escalation, change software configurations, and give them unauthorised access to information.  

D-Link “strongly recommend” that all users of the affected D-View 8 suite, which is users of versions 2.0.1.27 and below, apply the latest security update to receive the fixed version 2.0.1.28. However, despite this, D-Link have also published a note within their announcement that this new fixed version is a “device beta software, beta firmware, or hot-fix release”. This means that final testing is still being applied to this update and that this is not the official release yet, so any users who apply this update assume all associated risks when doing so, including not being liable for any loss experienced after applying the beta update. Users should therefore determine whether or not to apply this update immediately based on the specific security requirements of their organisation weighing the possible performance issues against the potential of an exploit for these critical severity flaws.