CVE-2023-44411

The InstallApplication class contains hardcoded credentials for a remotely accessible database. An attacker, without needing any credentials or user interaction, can use this password to establish a database connection and bypass the system's authentication mechanisms. The vulnerability is accessible remotely over the network, and the low attack complexity makes its exploitation relatively simple.

An attacker can completely bypass D-Link D-View system authentication, gaining unauthorized access to the database and potentially taking control of the network management system, resulting in violation of data confidentiality, integrity, and availability.

Patches available from the manufacturer should be applied in accordance with the references. Additionally, it is recommended to restrict network access to the D-View interface exclusively to trusted hosts and implement network segmentation to prevent unauthorized access to the management system.

D-Link D-View 8 — specific versions indicated in the manufacturer's references and in the Zero Day Initiative advisory (ZDI-CAN-19553)