CVE-2026-23755: CWE-427 Uncontrolled Search Path Element in D-Link D-View 8
D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full system compromise.
AI Analysis
Technical Summary
CVE-2026-23755 is a CWE-427 Uncontrolled Search Path Element vulnerability affecting D-Link D-View 8 versions 2.0.1.107 and earlier. The installer, when executed with elevated privileges, attempts to load version.dll from its current directory, enabling DLL preloading attacks. An attacker who can place a malicious version.dll in the installer's directory can execute arbitrary code with administrative rights after the victim approves the UAC prompt. This vulnerability arises from improper handling of DLL search paths during installation.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary code with administrator privileges on the affected system, potentially leading to full system compromise. The vulnerability requires user interaction to approve the UAC prompt and local access to place the malicious DLL alongside the installer. There are no known exploits in the wild at this time.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should avoid running the installer from untrusted directories and ensure the installer is executed from a secure location. Monitor vendor advisories for updates regarding a patch or official remediation. Exercise caution when approving UAC prompts for this product version.
CVE-2026-23755: CWE-427 Uncontrolled Search Path Element in D-Link D-View 8
Description
D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full system compromise.
CVSS v4.0
Score 8.4high
Affected software
D-Link
D-View 8
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-23755 is a CWE-427 Uncontrolled Search Path Element vulnerability affecting D-Link D-View 8 versions 2.0.1.107 and earlier. The installer, when executed with elevated privileges, attempts to load version.dll from its current directory, enabling DLL preloading attacks. An attacker who can place a malicious version.dll in the installer's directory can execute arbitrary code with administrative rights after the victim approves the UAC prompt. This vulnerability arises from improper handling of DLL search paths during installation.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary code with administrator privileges on the affected system, potentially leading to full system compromise. The vulnerability requires user interaction to approve the UAC prompt and local access to place the malicious DLL alongside the installer. There are no known exploits in the wild at this time.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should avoid running the installer from untrusted directories and ensure the installer is executed from a secure location. Monitor vendor advisories for updates regarding a patch or official remediation. Exercise caution when approving UAC prompts for this product version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-01-15T18:42:20.938Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 697119084623b1157ce3242c
Added to database: 01/21/2026, 18:20:56 UTC
Last enriched: 05/14/2026, 02:08:47 UTC
Last updated: 09/10/2026, 22:22:10 UTC
Views: 194
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.