Uncontrolled Search Path Vulnerability in D-Link D-View 8 Installer
CVE-2026-23755

8.4HIGH

Key Information:

Vendor

D-link
Status
D-view 8
Vendor
CVE Published:
21 January 2026

What is CVE-2026-23755?

The D-Link D-View 8 software versions up to 2.0.1.107 is susceptible to an uncontrolled search path vulnerability that affects its installer. When executed with elevated privileges, the installer attempts to load a crucial DLL from its execution directory, which can be manipulated by an attacker. By placing a malicious version.dll in the same directory, attackers can exploit this vulnerability by running the installer, which allows their unauthorized code to execute with administrative privileges. This situation potentially jeopardizes entire systems, necessitating urgent attention and remediation.

Affected Version(s)

D-View 8 0 <= 2.0.1.107

References

https://supportannouncement.us.dlink.com/security/publica...
vendor-advisorypatch
https://www.vulncheck.com/advisories/dlink-dview-8-instal...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, Security Researcher at GMO Cybersecurity by IERAE, Inc.
.