CVE-2023-44412: D-Link D-View addDv7Probe XXE information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote XXE with high confidentiality impact and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

D-Link D-View 8 contains an XML External Entity (XXE) flaw in the addDv7Probe function, where a crafted XML document with an external entity URI is parsed and its contents embedded back into the document. Because the parser does not restrict external entity references, an unauthenticated remote attacker can read files and data accessible to the service. The vulnerability is rated high severity (CVSS 8.2) and affects confidentiality with a limited availability impact.

Impact

An attacker can disclose sensitive information in the context of SYSTEM, including local files and data reachable by the D-View service account. This can expose credentials, configuration and other host data useful for follow-on attacks.

Attack surface

The flaw is reached remotely over the network through the addDv7Probe function, which processes attacker-supplied XML. No authentication and no user interaction are required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

The record shows no CISA KEV listing and no public exploit references beyond the ZDI advisory, but EPSS is very high (0.83681, 99.674th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor patch or fixed D-View 8 release for CVE-2023-44412 as soon as it is available.
• Disable external entity and DTD processing in the XML parser used by addDv7Probe.
• Restrict network access to the D-View management interface to trusted hosts and segments.
• Run the D-View service with least privilege rather than SYSTEM to limit file disclosure.
• Monitor vendor advisories for updated guidance if no patch is yet published.

Detection

• Inspect D-View and web server logs for requests to the addDv7Probe endpoint containing XML with DOCTYPE or ENTITY declarations.
• Alert on outbound connections from the D-View host to unexpected internal or external URIs, which may indicate XXE exfiltration.
• Monitor for unusual file reads by the D-View service process, especially access to sensitive system files.
• Review XML payloads for external entity references or file:// and http:// URIs in probe-related requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.