Threat Investigation
Request a demo

CVE-2023-50199

High

Description

D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to gain access to critical functions on the device. Was ZDI-CAN-21287.

SeverityHigh
CVSS8.8
Exploit probability—
ProductDlink G416 Firmware
PublishedMay 3, 2024
First seenMay 3, 2024
Weakness typeCWE-306Missing authentication for critical function

How to fix

Update
  • dlink g416_firmware1.09b01 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
dlink g416_firmwarev < 1.09b011.09b01

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.