A critical access control vulnerability in D-Link DSL-7740C firmware permits unauthenticated attackers to exfiltrate sensitive configuration data, including potential credentials.

The config.xgi function lacks proper authentication enforcement, enabling unauthenticated remote attackers to retrieve the device configuration file. This file often contains sensitive information required for further exploitation of the network.

Successful exploitation allows an attacker to gain deep insight into the internal network configuration, including administrative credentials and connection settings. Given the 9.8 CVSS score, this represents a high-impact breach of confidentiality that could facilitate lateral movement and further compromise of the internal environment.

Immediate Action: Verify if a firmware update is available from the vendor and apply it immediately to restrict unauthorized access to configuration endpoints.

Proactive Monitoring: Review web server access logs for repeated requests to the config.xgi endpoint originating from unauthorized sources.

Compensating Controls: Implement strict network access control lists (ACLs) to block external access to the device's management functions.

Public Exploit Available: False

This vulnerability presents a significant risk to sensitive information. Administrators must treat this as a high-priority item and ensure that the management interface of the DSL-7740C is not reachable from untrusted networks until a vendor-supplied patch is successfully deployed.