Description
D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing sensitive network credentials and system configurations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| D-Link | DSL-124 Wireless N300 ADSL2+ | ME_1.00 | — |
Advisories 1
- WID-SEC-2025-2912 D-LINK Router: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 22, 2025
References
- ExploitDB-51129 exploit
- D-Link Official Homepage product
- D-Link MEA Product Details Page product
- VulnCheck Advisory: D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request third-party-advisory