CVE-2023-50199 is a high severity (CVSS 8.8) missing authentication flaw in the httpd part of the HTTP service on the D-Link G416 4G Wi-Fi mobile router. Per the record, an attacker on the adjacent network needs no login and can bypass authentication and reach critical functions on the device. D-Link lists firmware v1.08b02 and below as affected and offers a hotfix build.
What's affected
- D-Link G416 wireless router, hardware revision Ax, firmware v1.08b02 and below, non-US region, according to D-Link's announcement SAP10367.
- Fixed: D-Link lists v1.09B01HotFix as the fix. As of the advisory's last update on 12 December 2023 it was a beta hotfix, with a fully qualified release for automatic download estimated for February 2024. Check D-Link for the current state, since we cannot confirm a final release.
- The NVD record lists the G416 firmware without version limits, while D-Link names v1.08b02 and below. Treat the vendor range as the reference.
- Conditions in the record: adjacent network attack vector, low complexity, no privileges, no user interaction.
- This issue was tracked by the Zero Day Initiative as ZDI-CAN-21287 and published as ZDI-23-1815.
- KEV status: the record shows kev as false, and neither advisory reports exploitation.
How to check if you're exposed
Open the router's web configuration page from the LAN and read the firmware version on the status or system page. The hardware revision is on the label under the device. If the device is a G416 revision Ax on v1.08b02 or older, treat it as affected.
There is no package manager step for firmware. The Safeguard Gold page for this CVE lists the record and its references, and is a convenient place to look for updates.
What to do now
- List every G416 in use, including spares and field units, with its firmware version and hardware revision.
- Download the hotfix from D-Link support for your hardware revision. Read the beta notice first, because D-Link provides it as is and says the user takes the risk.
- Keep untrusted devices off the router's LAN side, and do not expose the management web service on port 80 to any network you do not control.
- Where you can, limit access to the management interface to one admin machine or VLAN.
- Watch the D-Link announcement for the fully qualified firmware and move to it when it is published.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The description says the httpd service lets a requester reach functionality without any authentication step. Functions that change or reveal device state should always sit behind an identity check.
The record's title calls it a remote code execution vulnerability, but the description only says an attacker can gain access to critical functions without authenticating. We describe it at that level and do not assume more.
The G416 is a mobile router, which means it can sit in vehicles, remote sites and temporary offices where the LAN may be shared with guests or other devices. The adjacent attack vector means the attacker must already be on that local network, which narrows the audience but does not make the risk small. D-Link's announcement covers 20 related reports on the same model, so patching once to the fixed build is more practical than tracking each identifier alone.
Quick check
Do I need an account on the router to use this flaw?
No. The record says authentication is not required, but the attacker must be on the adjacent network.
Is a final fixed firmware available?
D-Link listed a beta hotfix, v1.09B01HotFix, and estimated a fully qualified release for February 2024. Check the D-Link announcement for the current status.
Sources
- NVD record for CVE-2023-50199
- D-Link announcement SAP10367
- Zero Day Initiative advisory ZDI-23-1815
Last reviewed: 19 October 2026.
