This vulnerability in D-Link M60 firmware version 1.20B02 allows remote attackers to manipulate an unknown functionality within the /usr/bin/httpd file, resulting in weak password recovery mechanisms. The attack vector is network-based (AV:N) and requires high complexity (AC:H) with no privileges or user interaction needed. The vulnerability has low impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). The exploit has been publicly disclosed but is difficult to execute, and no official fix or mitigation has been documented.

Successful exploitation could allow an attacker to bypass or weaken the password recovery process remotely, potentially leading to unauthorized access. However, the impact on confidentiality, integrity, and availability is rated low, and exploitation complexity is high. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Given the high complexity and low impact, immediate urgent action may not be required, but caution is advised.