CVE-2023-53974CWE-306

D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request

High · published December 22, 2025

CVSS v4.0
8.8
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

🚨 A single crafted POST request can hand over your entire router configuration! This vulnerability in D-Link DSL-124 is like leaving the back door wide open for anyone to waltz in and snoop around. 🔥 Imagine your house is a restaurant and your router settings are the secret recipes. If the front desk gives out the recipe book to anyone who asks, it's an absolute recipe for disaster! An attacker can exploit this vulnerability to retrieve sensitive network credentials and system configurations, possibly allowing them to take control of your network. This could lead to a full-blown invasion of your home network, where they can steal personal information, hijack devices, or even launch further attacks!

Put simply

Imagine your house is a restaurant and your router settings are the secret recipes. If the front desk gives out the recipe book to anyone who asks, it's an absolute recipe for disaster! The CVE-2023-53974 vulnerability allows unauthenticated attackers to access router settings through a POST request directed at the router's configuration endpoint, enabling them to download a complete backup file containing sensitive information.

What to do

An attacker can exploit this vulnerability to retrieve sensitive network credentials and system configurations, possibly allowing them to take control of your network. This could lead to a full-blown invasion of your home network, where they can steal personal information, hijack devices, or even launch further attacks! To protect yourself, update your D-Link DSL-124 router firmware to the latest version as soon as possible. Additionally, consider changing the default settings and enhancing your network security measures to prevent unauthorized access. You've got this! Follow these steps, and you'll have your network secured in no time! 🛡️

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-22T21:35Z
EPSS history
Timeline
  • 22 DEC 21:35Z
    D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request
    cvelistv5