D-Link D-View 8 Improper Access Control Vulnerability Allowing Credential Disclosure and Account Takeover

An improper access control vulnerability has been identified in D-Link D-View 8 versions 2.0.1.107 and prior. This vulnerability exists in backend API endpoints, where authenticated users can manipulate the user_id parameter to access sensitive credential information belonging to other users, including super administrators. The leaked credentials can be used as valid authentication tokens, enabling full impersonation of the targeted user and complete administrative control over the D-View system.

Impact

Exploitation of this vulnerability allows for unauthorized access to user credentials, including those of super administrators, leading to full account takeover and administrative control over the D-View system.

Remediation

Users are advised to update to D-Link D-View 8 version 2.0.5.109 Beta. This beta version can be downloaded from the D-Link D-View Free Trial page. After updating, it is important to verify the success of the update by checking the firmware version on the product interface.