CVE-2023-44414
D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the coreservice_action_script action. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19573.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 3.85%
- CWE
- CWE-749
- Published
- 2024-05-03
- Last modified
- 2026-03-13
Affected products
- D-Link D-View
Weakness type
Related vulnerabilities
- CVE-2018-10931 — It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unaut
- CVE-2023-27363 — Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2023-38124 — Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability
- CVE-2023-51581 — Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2023-51575 — Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2021-34996 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.
- CVE-2023-51582 — Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2026-30957 — OneUptime Synthetic Monitor RCE via exposed Playwright browser object