CVE-2023-50210 is a high severity (CVSS 8.8) stack based buffer overflow in the httpd digest part of the HTTP service on the D-Link G416 4G Wi-Fi mobile router. Per the record, an attacker on the adjacent network needs no login and can execute code with root privileges. D-Link lists firmware v1.08b02 and below as affected and offers a hotfix build.
What's affected
- D-Link G416 wireless router, hardware revision Ax, firmware v1.08b02 and below, non-US region, according to D-Link's announcement SAP10367.
- Fixed: D-Link lists v1.09B01HotFix as the fix. As of the advisory's last update on 12 December 2023 it was a beta hotfix, with a fully qualified release for automatic download estimated for February 2024. Check D-Link for the current state, since we cannot confirm a final release.
- The NVD record lists the G416 firmware without version limits, while D-Link names v1.08b02 and below. Treat the vendor range as the reference.
- Conditions in the record: adjacent network attack vector, low complexity, no privileges, no user interaction.
- This issue was tracked by the Zero Day Initiative as ZDI-CAN-21662 and published as ZDI-23-1826.
- KEV status: the record shows kev as false, and neither advisory reports exploitation.
How to check if you're exposed
Open the router's web configuration page from the LAN and read the firmware version on the status or system page. The hardware revision is on the label under the device. If the device is a G416 revision Ax on v1.08b02 or older, treat it as affected.
There is no package manager step for firmware. The Safeguard Gold page for this CVE lists the record and its references, and is a convenient place to look for updates.
What to do now
- List every G416 in use, including spares and field units, with its firmware version and hardware revision.
- Download the hotfix from D-Link support for your hardware revision. Read the beta notice first, because D-Link provides it as is and says the user takes the risk.
- Keep untrusted devices off the router's LAN side, and do not expose the management web service on port 80 to any network you do not control.
- Where you can, limit access to the management interface to one admin machine or VLAN.
- Watch the D-Link announcement for the fully qualified firmware and move to it when it is published.
Why it matters
The weakness is CWE-121, a stack based buffer overflow, which the record also files under CWE-787, out of bounds write. The description says the service copies user supplied data into a fixed length stack buffer without checking its length first. Data longer than the buffer overwrites neighbouring memory, and on a device without strong memory protections that can be turned into code execution.
The affected handler runs inside the root level web service, so the same logic applies as with the command injection issues in this batch: one bad request path is enough to control the router. The fix for this class is a bounds check before the copy.
The G416 is a mobile router, which means it can sit in vehicles, remote sites and temporary offices where the LAN may be shared with guests or other devices. The adjacent attack vector means the attacker must already be on that local network, which narrows the audience but does not make the risk small. D-Link's announcement covers 20 related reports on the same model, so patching once to the fixed build is more practical than tracking each identifier alone.
Quick check
Do I need an account on the router to use this flaw?
No. The record says authentication is not required, but the attacker must be on the adjacent network.
Is a final fixed firmware available?
D-Link listed a beta hotfix, v1.09B01HotFix, and estimated a fully qualified release for February 2024. Check the D-Link announcement for the current status.
Sources
- NVD record for CVE-2023-50210
- D-Link announcement SAP10367
- Zero Day Initiative advisory ZDI-23-1826
Last reviewed: 19 October 2026.
