This vulnerability arises from improper session management in the D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00. Attackers can exploit this flaw by spoofing the IP address of an authenticated user to hijack their session. The CVSS v3.1 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability relates to weaknesses identified by CWE-384 (Session Fixation), CWE-287 (Improper Authentication), and CWE-345 (Insufficient Verification of Data Authenticity). There are no known exploits in the wild or vendor patches available at this time.

Successful exploitation allows an attacker to hijack a legitimate user's session by spoofing their IP address, potentially leading to unauthorized actions with high integrity impact on the device. Confidentiality impact is low, and availability is not affected. This could compromise the security of the affected router and any network relying on it for connectivity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patches or official fixes are currently documented, users should monitor for vendor updates. Until a fix is available, restricting network access to the router's management interface and using network-level protections may reduce exposure.