If the server returns a configuration panel or a raw file listing showing parameters like ?frame=1 or ?user=admin , the attacker notes the inputs.
Prevent view index by configuring your web server (or embedded OS) to deny directory listings. A proper configuration returns 403 Forbidden when accessing /cgi-bin/view/ .