G416 LAN-Side Unathenticated Command Injection
23 listopada, 2023
Overview
On July 7, 2023 and July 28, 2023, 3rd party security research from TrendMicro ZDI reported the (Non-US) D-Link G416 WiFi 4G Mobile Router H/W Rev. Ax :: F/W v1.08b02 having multiple security vulnerabilities.
An OS command injection vulnerability has been discovered in D-Link G416, which can be exploited by unauthenticated attackers that get access to the LANside of the device to execute arbitrary code with root privileges.
D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures.
Report information
- Reported by TrendMicro ZDI
July 13, 2023 Report
- 1. ZDI-CAN-21286: D-Link G416 cfgsave Command Injection Remote Code Execution Vulnerability
- 2. ZDI-CAN-21287: D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability
- 3. ZDI-CAN-21288: D-Link G416 cfgsave backusb Command Injection Remote Code Execution Vulnerability
- 4. ZDI-CAN-21289: D-Link G416 cfgsave upusb Command Injection Remote Code Execution Vulnerability
- 5. ZDI-CAN-21299: D-Link G416 flupl query_type edit Command Injection Remote Code Execution Vulnerability
- 6. ZDI-CAN-21300: D-Link G416 flupl filename Command Injection Remote Code Execution Vulnerability
- 7. ZDI-CAN-21441: D-Link G416 ovpncfg Stack-based Buffer Overflow Remote Code Execution Vulnerability
- 8. ZDI-CAN-21662: D-Link G416 httpd API-AUTH Digest Processing Stack-based Buffer Overflow Remote Code Execution Vulnerability
- 9. ZDI-CAN-21663: D-Link G416 hOpd API-AUTH Timestamp Processing Stack-based Buffer Overflow Remote Code ExecuZon Vulnerability
- 10. ZDI-CAN-21664: D-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure Vulnerability
July 28, 2023 Report
- 11. ZDI-CAN-21295: D-Link G416 flupl pythonmodules Command Injection Remote Code Execution Vulnerability
- 12. ZDI-CAN-21297: D-Link G416 flupl pythonapp Command Injection Remote Code Execution Vulnerability
- 13. ZDI-CAN-21442: D-Link G416 cfgsave Stack-Based Buffer Overflow Remote Code Execution Vulnerability
- 14. ZDI-CAN-21298: D-Link G416 awsfile chmod Command Injection Remote Code Execution Vulnerability
- 15. ZDI-CAN-21296: D-Link G416 nodered chmod Command Injection Remote Code Execution Vulnerability
- 16. ZDI-CAN-21807: D-Link G416 nodered File Handling Command Injection Remote Code Execution Vulnerability
- 17. ZDI-CAN-21808: D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability
- 18. ZDI-CAN-21809: D-Link G416 nodered gz File Handling Command Injection Remote Code Execution Vulnerability
- 19. ZDI-CAN-21810: D-Link G416 awsfile tar File Handling Command Injection Remote Code Execution Vulnerability
- 20. ZDI-CAN-21811: D-Link G416 awsfile rm Command Injection Remote Code Execution Vulnerability
Affected Model(s)
Model | Affected Version |
Fixed Release |
Recommendation | Last Updated |
G416 |
v1.08b02and below | v1.09B01_beta* | Download and update |
12/12/2023 |
* Fully Qualified Release for Automatic Download estimate February 2024