CVE-2026-23755
Last modified
CVE-2026-23755 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full system compromise.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dlink | D-View 8 | <= 2.0.1.107 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-23755?
How severe is CVE-2026-23755?
How do I fix CVE-2026-23755?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2375The App Builder – Create Native Android & iOS Apps On The Fl…6.5
- CVE-2026-23750Golioth Pouch version 0.1.0, prior to commit 1b2219a1, conta…8.1
- CVE-2026-23751Kofax Capture, now referred to as Tungsten Capture, version …9.8
- CVE-2026-23752GFI HelpDesk before 4.99.9 contains a stored cross-site scri…4.8
- CVE-2026-23753GFI HelpDesk before 4.99.9 contains a stored cross-site scri…4.8
- CVE-2026-23754D-Link D-View 8 versions 2.0.1.107 and below contain an impr…8.8
- CVE-2026-23756GFI HelpDesk before 4.99.9 contains a stored cross-site scri…5.4
- CVE-2026-23757GFI HelpDesk before 4.99.10 contains a stored cross-site scr…5.4
- CVE-2026-23758GFI HelpDesk before 4.99.9 contains a stored cross-site scri…5.4
- CVE-2026-23759Perle IOLAN STS/SCS terminal server models with firmware ver…8.6
- CVE-2026-2376A flaw was found in mirror-registry where an authenticated u…5.4
- CVE-2026-23760SmarterTools SmarterMail versions prior to build 9511 contai…9.8
Are you affected by CVE-2026-23755?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST