ZDI-CAN-21664: ZDI-23-1828: D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability
First published: Wed Dec 20 2023(Updated: )
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper handling of error conditions. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| D-Link G416 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-21664?
ZDI-CAN-21664 is classified as a medium-severity vulnerability due to its potential to disclose sensitive information.
How do I fix ZDI-CAN-21664?
To mitigate ZDI-CAN-21664, ensure your D-Link G416 router firmware is updated to the latest version provided by D-Link.
Who is affected by ZDI-CAN-21664?
ZDI-CAN-21664 affects installations of D-Link G416 routers that are accessible over a network.
Is authentication required to exploit ZDI-CAN-21664?
No, authentication is not required to exploit the ZDI-CAN-21664 vulnerability.
What type of attacks can occur due to ZDI-CAN-21664?
Due to ZDI-CAN-21664, network-adjacent attackers can potentially disclose sensitive information.
- collector/zdi-published
- alias/ZDI-CAN-21664
- agent/first-publish-date
- agent/last-modified-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-23-1828
- alias/CVE-2023-50212
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/title
- agent/description
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- agent/type
- vendor/d-link
- canonical/d-link g416