CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303) allows unauthenticated attackers to perform arbitrary modification (read, write) to passwords and configurations as long as the Administrator is connected to the web interface. For example, GET /romfile.cfg allows the attacker to retrieve the complete settings of the router (all credentials included) while POST /cgi-bin/New_GUI/Set/Admin.asp allows the attacker to successfully change the password of the Web Interface.

Source: CVE-2018-8898