Vulnerability record · CVE-2020-25078 · published 2 September 2020
CVE-2020-25078: D-Link DCS cameras expose admin password via unauthenticated endpoint
Dlink · Dcs 4603 Firmware
D-Link DCS-2530L (before 1.06.01 Hotfix) and DCS-2670L (through 2.02) expose an unauthenticated /config/getuser endpoint that returns the remote administrator password. Because the credential is disclosed without any authentication, anyone who can reach the device's web interface can obtain administrative access.
Description
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
critical priorityThe flaw allows unauthenticated disclosure of administrator credentials, is listed in CISA KEV, and has an EPSS probability near 0.98.
What it is
D-Link DCS-2530L (before 1.06.01 Hotfix) and DCS-2670L (through 2.02) expose an unauthenticated /config/getuser endpoint that returns the remote administrator password. Because the credential is disclosed without any authentication, anyone who can reach the device's web interface can obtain administrative access.
Impact
An attacker gains the device administrator password, enabling full control of the camera, including viewing its video feed and changing its configuration.
Attack surface
Reachable over the network via HTTP to the /config/getuser endpoint; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Listed in CISA KEV (added 2025-08-05) and carries an EPSS 30-day probability of 0.979 (99.9th percentile), indicating active exploitation and very high likelihood of attempts.
What to do
- Apply the D-Link firmware fix per vendor advisory SAP10180 (DCS-2530L 1.06.01 Hotfix or later; check DCS-2670L guidance).
- If firmware cannot be applied, discontinue use or isolate affected cameras on a segmented network with no internet exposure, per CISA BOD 22-01 guidance.
- Block external access to camera HTTP interfaces and restrict management access to trusted internal hosts only.
- Change the administrator password on any potentially exposed device and audit for unauthorized configuration changes.
Detection
- Monitor web logs and network traffic for unauthenticated requests to /config/getuser on D-Link camera hosts.
- Alert on inbound access to camera management interfaces from untrusted or external IP addresses.
- Review camera configuration and account changes for signs of unauthorized administrative access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-25078 to the Known Exploited Vulnerabilities catalog on 5 August 2025 as "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 26 August 2025.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 | PatchVendor Advisory |
| https://twitter.com/Dogonsecurity/status/1273251236167516161 | Broken LinkThird Party Advisory |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180 | PatchVendor Advisory |
| https://twitter.com/Dogonsecurity/status/1273251236167516161 | Broken LinkThird Party Advisory |
| https://support.dlink.com/productinfo.aspx?m=DCS-2530L | Product |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078 | US Government Resource |
Track CVE-2020-25078 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25078), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
