CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cve@mitre.org

Published

2020-09-02

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2025-08-05, action due 2025-08-26: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products

• Dcs-2530l Firmware (Dlink)
• Dcs-2670l Firmware (Dlink)
• Dcs-4603 Firmware (Dlink)
• Dcs-4622 Firmware (Dlink)
• Dcs-4701e Firmware (Dlink)
• Dcs-4703e Firmware (Dlink)
• Dcs-4705e Firmware (Dlink)
• Dcs-4802e Firmware (Dlink)
• Dcs-p703 Firmware (Dlink)

References

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
• https://twitter.com/Dogonsecurity/status/1273251236167516161
• https://support.dlink.com/productinfo.aspx?m=DCS-2530L
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078