PT-2023-7949 · D Link · D-Link G416

Sina Kheirkhah + 1 · Published 2023-07-14 · Updated 2024-05-03 · CVE-2023-50199

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link G416 (affected versions not specified)

Description The issue is related to a lack of authentication for a critical function in the httpd daemon of the D-Link G416 router's firmware. This allows a remote attacker to bypass security restrictions. The specific flaw exists within the HTTP service listening on TCP port 80, and it results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to gain access to critical functions on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-09033

CVE-2023-50199

ZDI-23-1815

Affected Products

D-Link G416

References · 9

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50199 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1815 · Security Note
• https://bdu.fstec.ru/vul/2023-09033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-50199 · Security Note
• https://twitter.com/TheZDIBugs/status/1737527878915404112 · Twitter Post
• https://twitter.com/vuldb/status/1737534338877857804 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023122131 · Note
• https://twitter.com/CVEnew/status/1786444212080390369 · Twitter Post