Unauthenticated attackers can extract sensitive configuration data, including network credentials, from the D-Link DSL-124 router, posing a significant risk of unauthorized network access.

This is a configuration file disclosure vulnerability (CWE-306) caused by a lack of authentication checks on the /form2saveConf.cgi endpoint. An unauthenticated attacker can retrieve the router's complete backup configuration file by sending a crafted POST request.

The compromise of router configuration files often results in the exposure of administrative passwords, Wi-Fi keys, and network topology details. With a CVSS score of 7.5, this high-severity flaw enables attackers to gain persistent unauthorized access to the network or facilitate further lateral movement, significantly increasing the risk of data breaches and internal system compromise.

Immediate Action: Contact D-Link support or check the official vendor portal for available firmware updates beyond version ME_1.00, as no public patch is currently confirmed. If no update is available, disconnect the device from the public internet immediately.

Proactive Monitoring: Review firewall and access logs for suspicious POST requests targeting the /form2saveConf.cgi endpoint. Monitor for unexpected modifications to network settings or unauthorized device connectivity.

Compensating Controls: Implement strict access control lists on the router to restrict management access to trusted internal IP addresses only. Disable remote management features if they are not strictly required for business operations.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 51129.

Given the ease of exploitation and the sensitivity of the exposed data, organizations using the D-Link DSL-124 must prioritize securing these devices. If a firmware update remains unavailable, the device should be segmented from critical network segments or replaced with a supported model to prevent potential credential theft and full network compromise.