CVE-2023-32164: D-Link D-View TFTP path traversal allows unauthenticated file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote file disclosure with SYSTEM-level read access and a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

D-Link D-View contains a directory traversal flaw in the TftpSendFileThread class, where a user-supplied path is used in file operations without proper validation. Because the flaw is reachable over the network without authentication, it exposes sensitive files on affected installations. The record does not specify which D-View 8 builds are affected beyond the product listing.

Impact

An attacker can read arbitrary files on the host in the context of SYSTEM, exposing configuration, credential and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable remotely over the network via the TFTP file handling path, with no authentication and no user interaction required (AV:N/PR:N/UI:N). Any host that can reach the D-View TFTP service can attempt the traversal.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high at 0.8487 (99.7th percentile), indicating elevated predicted exploitation activity. The vendor and ZDI advisories confirm the flaw but do not state observed in-the-wild use.

What to do

• Apply the D-Link vendor advisory SAP10332 fix for D-View 8 as the first action.
• If patching cannot be done immediately, restrict network access to the D-View TFTP service to trusted management hosts only.
• Disable or block the TFTP service on D-View hosts where it is not operationally required.
• Run D-View with least privilege rather than SYSTEM where the product allows it, to limit file exposure.
• Monitor vendor channels for updated affected-version guidance since the record does not enumerate them.

Detection

• Review TFTP service logs for file requests containing traversal sequences such as ../ or encoded variants.
• Alert on TFTP reads of files outside the expected D-View data directories, especially system files.
• Baseline normal TFTP client sources and flag requests from unexpected or external IP addresses.
• Correlate D-View host file access events with inbound TFTP connections for anomalous read patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.