CVE-2023-50199: D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability
D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to gain access to critical functions on the device. Was ZDI-CAN-21287.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50199?
CVE-2023-50199 is categorized as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-50199?
To mitigate CVE-2023-50199, ensure that your D-Link G416 router firmware is updated to the latest version provided by D-Link.
Who is affected by CVE-2023-50199?
CVE-2023-50199 affects installations of the D-Link G416 router that have not implemented security measures.
What type of attack does CVE-2023-50199 enable?
CVE-2023-50199 allows network-adjacent attackers to bypass authentication and execute arbitrary code on affected devices.
Is there a workaround for CVE-2023-50199 before a patch is available?
Currently, there are no known workarounds for CVE-2023-50199 other than restricting access to the router's administrative interface.