CVE-2023-5145 is a critical unrestricted file upload vulnerability found in the D-Link DAR-7000 router, specifically within the /sysmanage/licence.php file when handling the 'file_upload' argument. This vulnerability allows for remote exploitation and affects products that are end-of-life and no longer supported by D-Link. The CVSS score of 8.8 (High) indicates a severe risk, with a low attack complexity and no user interaction required, potentially leading to high impacts on confidentiality, integrity, and availability. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). While public exploit code has been disclosed, there is no evidence of active exploitation in the wild, nor is it listed in the CISA KEV catalog. Community discussion and media coverage are minimal, which is typical for many CVEs.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 20151231CPE matchmatch criteria | cpe:2.3:o:dlink:dar-7000_firmware:*:*:*:*:*:*:*:* | ||
<= 20151231CPE matchmatch criteria | cpe:2.3:o:dlink:dar-8000_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.