CVE-2023-32165: D-Link D-View TFTP handler path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable path traversal leading to SYSTEM code execution, with a CVSS of 9.8 and very high EPSS, makes this an urgent patching priority.

What it is

D-Link D-View contains a directory traversal flaw in the TftpReceiveFileHandler class, where a user-supplied path is used in file operations without proper validation. Because the flaw is reachable without authentication and can result in code execution as SYSTEM, it is a serious risk for exposed D-View installations.

Impact

A remote attacker can write files outside the intended directory and execute arbitrary code with SYSTEM privileges on the affected host. This gives full control of the D-View server and any data or credentials it manages.

Attack surface

The vulnerability is network-reachable through the TFTP file handling component, with no authentication and no user interaction required per the CVSS vector. Any host that can reach the D-View TFTP service can attempt exploitation.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit-tag references, but EPSS is very high at 0.733 (99.4th percentile), indicating elevated near-term exploitation likelihood.

What to do

• Apply the D-Link vendor advisory SAP10332 update for D-View as the first action.
• Restrict network access to the D-View TFTP service to trusted management hosts only.
• If the TFTP component is not required, disable or block it at the host firewall.
• Run D-View with least privilege where possible and isolate it from sensitive network segments.
• Monitor vendor channels for further D-View security updates and re-check exposure after patching.

Detection

• Monitor TFTP traffic to D-View hosts for path traversal sequences such as ../ in filenames or requests.
• Alert on unexpected file creation or modification in D-View installation and system directories.
• Watch for new processes spawned by the D-View service, especially those running as SYSTEM.
• Review D-View and TFTP service logs for anomalous file transfer requests from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.