CVE-2023-32167: D-Link D-View uploadMib path traversal allows arbitrary file creation and deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows SYSTEM-level arbitrary file creation and deletion, and while it requires high privileges, the very high EPSS score signals elevated exploitation likelihood.

What it is

The uploadMib function in D-Link D-View fails to validate a user-supplied path before using it in file operations, allowing directory traversal. An authenticated remote attacker can create or delete arbitrary files, and the flaw runs in the SYSTEM context, so file operations affect the whole host.

Impact

An attacker gains the ability to create or delete arbitrary files as SYSTEM, which can corrupt the application, remove security-relevant files, or plant files that lead to further compromise. Integrity and availability are both rated high; confidentiality is not affected per the CVSS vector.

Attack surface

Reachable over the network through the D-View web interface (AV:N) with no user interaction (UI:N), but it requires high privileges (PR:H), meaning the attacker must already hold an administrative or equivalent authenticated account.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.76504 (99.5th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the D-Link vendor advisory SAP10332 update for D-View 8 as the first action.
• Restrict network access to the D-View management interface to trusted administrative networks only.
• Audit and minimize accounts with the high privileges needed to reach uploadMib, and rotate credentials for those accounts.
• Monitor and alert on unexpected file creation or deletion in D-View installation and system directories.
• If patching is delayed, isolate the D-View server from untrusted networks and back up critical files for integrity comparison.

Detection

• Monitor D-View and web server logs for uploadMib requests containing traversal sequences such as ../ or encoded variants.
• Alert on file creation or deletion events in D-View installation paths and SYSTEM-writable directories outside normal update windows.
• Baseline and integrity-check critical D-View and system files, alerting on unexpected hash or timestamp changes.
• Correlate D-View administrative logins with subsequent file system changes on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.