CVE-2023-5147 - D-Link DAR-7000 updateos.php unrestricted upload

Back Back to CVE browser

HIGH

D-Link DAR-7000 updateos.php unrestricted upload

Published Sep 25, 2023

8.8

HIGH

CVSS 3.1

EPSS 26.44%

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240243. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Affected products

Vendor D-Link Product n/a Default
n/a
- Version
  20151231
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

D-Link

n/a

Version	Status	Constraints
20151231	affected	-

Vendor D-Link Product Dar-7000 Firmware Default
n/a
- Version
  2015-12-31
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

D-Link

Dar-7000 Firmware

n/a

Version	Status	Constraints
2015-12-31	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57485
Advisory
https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20updateos.md
exploitpatchThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354
relatedVendor Advisory
https://vuldb.com/?ctiid.240243
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.240243
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57485		Advisory
https://github.com/llixixi/cve/blob/main/D-LINK-DAR-7000_upload_%20updateos.md		exploitpatchThird Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354		relatedVendor Advisory
https://vuldb.com/?ctiid.240243		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.240243		vdb-entrytechnical-descriptionThird Party Advisory