The vulnerability is a credential disclosure flaw that allows an unauthenticated attacker who can send POST requests to /my_cgi.cgi to manipulate the table_name parameter. By using values such as admin_user, wireless_settings, or wireless_security, the attacker can retrieve administrative passwords and wireless keys in clear text. The primary consequence is a breach of confidentiality, as the attacker gains privileged network credentials and wireless network secrets without needing any authentication.

The weakness affects D‑Link routers with the DIR601NA model running firmware version 2.02NA.

The CVSS score of 8.7 classifies this as high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw simply by sending unauthenticated HTTP POST requests over the network; no special access or privileges are required. Because the data is transmitted in clear text, any adversary with network access to the router can extend their intrusion, potentially compromising the entire local network.