CVE-2023-50206 is a high severity (CVSS 8.8) OS command injection flaw in the flupl query_type part of the HTTP service on the D-Link G416 4G Wi-Fi mobile router. Per the record, an attacker on the adjacent network needs no login and can execute code with root privileges. D-Link lists firmware v1.08b02 and below as affected and offers a hotfix build.
What's affected
- D-Link G416 wireless router, hardware revision Ax, firmware v1.08b02 and below, non-US region, according to D-Link's announcement SAP10367.
- Fixed: D-Link lists v1.09B01HotFix as the fix. As of the advisory's last update on 12 December 2023 it was a beta hotfix, with a fully qualified release for automatic download estimated for February 2024. Check D-Link for the current state, since we cannot confirm a final release.
- The NVD record lists the G416 firmware without version limits, while D-Link names v1.08b02 and below. Treat the vendor range as the reference.
- Conditions in the record: adjacent network attack vector, low complexity, no privileges, no user interaction.
- This issue was tracked by the Zero Day Initiative as ZDI-CAN-21299 and published as ZDI-23-1822.
- KEV status: the record shows kev as false, and neither advisory reports exploitation.
How to check if you're exposed
Open the router's web configuration page from the LAN and read the firmware version on the status or system page. The hardware revision is on the label under the device. If the device is a G416 revision Ax on v1.08b02 or older, treat it as affected.
There is no package manager step for firmware. The Safeguard Gold page for this CVE lists the record and its references, and is a convenient place to look for updates.
What to do now
- List every G416 in use, including spares and field units, with its firmware version and hardware revision.
- Download the hotfix from D-Link support for your hardware revision. Read the beta notice first, because D-Link provides it as is and says the user takes the risk.
- Keep untrusted devices off the router's LAN side, and do not expose the management web service on port 80 to any network you do not control.
- Where you can, limit access to the management interface to one admin machine or VLAN.
- Watch the D-Link announcement for the fully qualified firmware and move to it when it is published.
Why it matters
The weakness is CWE-78, improper neutralization of special elements used in an OS command. The description says the flupl query_type handler takes a string supplied by the requester and uses it in a system call without validating it first. When input reaches a shell command unchecked, special characters can change which command runs.
On this device the web service runs with root privileges, so a flaw in a handler like this one hands over the whole router. Safe code passes arguments to programs as a fixed list, avoids the shell, and rejects anything outside an expected format.
The G416 is a mobile router, which means it can sit in vehicles, remote sites and temporary offices where the LAN may be shared with guests or other devices. The adjacent attack vector means the attacker must already be on that local network, which narrows the audience but does not make the risk small. D-Link's announcement covers 20 related reports on the same model, so patching once to the fixed build is more practical than tracking each identifier alone.
Quick check
Do I need an account on the router to use this flaw?
No. The record says authentication is not required, but the attacker must be on the adjacent network.
Is a final fixed firmware available?
D-Link listed a beta hotfix, v1.09B01HotFix, and estimated a fully qualified release for February 2024. Check the D-Link announcement for the current status.
Sources
- NVD record for CVE-2023-50206
- D-Link announcement SAP10367
- Zero Day Initiative advisory ZDI-23-1822
Last reviewed: 19 October 2026.
