CVE-2023-34856

MediumCVSS 5.4

Published: 09/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

45th percentile - higher than 45% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /auth_pic.cgi.

Risk Assessment

This vulnerability could lead to device takeover and allow attackers to execute malicious code in the user's context.

Recommendation

It is recommended to update the device firmware to the latest version and restrict access to the administrative interface.

Original NVD description (English source)

A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /auth_pic.cgi.