The vulnerability is a path traversal flaw in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E routers. An unauthenticated remote attacker can supply crafted requests to the getpage parameter in the /cgi-bin/webproc CGI script, allowing the attacker to read arbitrary files from the device. This can lead to disclosure of sensitive configuration, credentials, or firmware files, thereby compromising confidentiality and potentially enabling further compromise of the network segment the router protects.

The flaw affects D-Link DSL-2730U, DSL-2750U, and DSL-2750E routers running firmware versions IN_1.02, SEA_1.04, or SEA_1.07. The affected products are commonly used in small‑business and residential environments where the router’s web interface is exposed to WAN or internal networks.

The CVSS score of 8.7 classifies the issue as high severity, and the EPSS score below 1% indicates that exploitation may currently be uncommon, yet the ability to read arbitrary files without authentication remains a serious threat. The vulnerability is not listed in the CISA KEV catalog, but the existence of publicly available proof‑of‑concept code and documented exploitation suggests that attackers could target vulnerable devices if it remains unpatched. The attack requires network connectivity to the router’s management interface and does not rely on privileged access or knowledge of credentials.