A flaw in the web interface of certain D-Link DGS‑1100‑08PD routers allows an attacker to manipulate the /etc/boa.conf file, leading to a least‑privilege violation. The vulnerability is tied to improper authorization checks (CWE‑266) and insufficient privilege separation (CWE‑272). As a result, an attacker who succeeds in modifying this file could alter configuration settings or elevate privileges for subsequent attacks, potentially compromising the confidentiality, integrity, or availability of the device.

D‑Link DGS‑1100‑08PD routers running firmware version 1.00.006 are affected. No other versions or models are reported to be vulnerable in the available data.

The CVSS score of 6.3 categorizes the risk as medium. Although the EPSS score is not available, the advisory states that a publicly available exploit exists, making the vulnerability realistic to mount under the right conditions. The attack is remote, requiring a high level of complexity and difficult to execute, but not impossible. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet, yet the public availability of an exploit warrants caution.