CVE-2020-25078
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
Description
CVE-2020-25078 is a high-severity information disclosure vulnerability in D-Link network cameras, including the DCS-2530L and DCS-2670L models. The flaw exists in the unauthenticated /config/getuser endpoint, which allows remote attackers to retrieve the administrator password without any authentication. Rated at a CVSS v3.1 score of 7.5, this vulnerability requires no privileges, no user interaction, and can be exploited remotely over the network. CISA has added CVE-2020-25078 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 26, 2025, and its EPSS score of 94.15% at the 99th percentile reflects one of the highest exploitation probabilities across all known vulnerabilities, indicating massive automated exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dcs-4603 firmware | < 1.04.02 |
| dlink | dcs-4622 firmware | < 2.01.10 |
| dlink | dcs-4701e firmware | < 2.03.01 |
| dlink | dcs-4703e firmware | < 1.03.04 |
| dlink | dcs-4705e firmware | < 1.03.02 |
| dlink | dcs-4802e firmware | < 2.01.01 |
| dlink | dcs-p703 firmware | All versions |
| dlink | dcs-2530l firmware | <= 1.05.05 |
| dlink | dcs-2670l firmware | < 2.03.00 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180(Patch, Vendor Advisory)
- https://twitter.com/Dogonsecurity/status/1273251236167516161(Broken Link, Third Party Advisory)
- https://support.dlink.com/productinfo.aspx?m=DCS-2530L(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078(US Government Resource)
Weakness Type
This vulnerability does not have a specific CWE classification assigned in the NVD data. The underlying weakness is an unauthenticated API endpoint that exposes sensitive credential data. The /config/getuser endpoint returns administrator credentials to any requester without requiring authentication, representing a direct access control failure and sensitive information exposure.
Impact Analysis
CVE-2020-25078 has critical implications for organizations deploying D-Link surveillance cameras. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): the exposed administrator password grants full access to the camera's configuration, live video feeds, recorded footage, network settings, and any other data stored on the device. The scope is unchanged (S:U), meaning the direct impact is limited to the vulnerable camera, but obtaining admin credentials often enables pivoting to other network devices. Integrity and Availability are not directly impacted by the information disclosure itself (I:N, A:N), but the disclosed credentials enable secondary attacks including reconfiguring cameras, disabling recording, altering motion detection zones, or using the compromised camera as a network pivot point. The extremely high EPSS score of 94.15% confirms that botnets and automated scanners are actively harvesting these credentials at scale across multiple D-Link camera product lines including DCS-4603, DCS-4622, DCS-4701E, DCS-4703E, DCS-4705E, DCS-4802E, and DCS-P703.
Exploit Maturity
CVE-2020-25078 has an extremely mature and widely automated exploit landscape. CISA has confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 94.15% at the 99th percentile places this vulnerability among the most exploited across all tracked CVEs, indicating pervasive automated scanning and credential harvesting. The trivial nature of the exploit, requiring only an HTTP request to the /config/getuser endpoint without any authentication, makes it ideal for botnet operators who scan the internet for exposed D-Link cameras. The vendor advisory provides patch information, but many affected models have reached end of life. IoT cameras are frequently left unpatched and exposed to the internet, making this vulnerability a persistent threat for building botnets and conducting surveillance.
Remediation
-
Apply firmware updates from D-Link for all affected camera models. Refer to the D-Link Security Advisory SAP10180 for model-specific firmware versions that address this vulnerability: DCS-2530L requires firmware 1.06.01 Hotfix, DCS-2670L requires firmware beyond 2.02, and other affected models have specific patched versions.
-
Isolate cameras from the internet immediately. D-Link surveillance cameras should never be directly accessible from the public internet. Place all cameras behind a firewall or VPN and restrict access to the management interface to trusted internal networks only.
-
Change administrator passwords on all affected cameras immediately, as existing credentials may have already been harvested by automated scanners. Use strong, unique passwords for each device and do not reuse credentials across cameras or other network devices.
-
Replace end-of-life models such as the DCS-P703 (which has no patch available) with currently supported camera models that receive regular security updates. Continuing to operate cameras without available patches is an unacceptable risk.
-
Monitor network traffic from camera devices for unusual outbound connections, DNS requests to unknown domains, or unexpected traffic volumes that could indicate the cameras have been recruited into a botnet. Implement network segmentation to limit the blast radius if a camera is compromised.
Technical Details
CVE-2020-25078 is an unauthenticated information disclosure vulnerability in D-Link network cameras. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a purely network-based confidentiality impact with no authentication or user interaction required. The vulnerability exists in the /config/getuser endpoint of the camera's web interface, which returns the administrator username and password in plaintext to any HTTP request without requiring authentication. This endpoint was likely intended for internal configuration management but was inadvertently exposed to unauthenticated access. The exploit is trivially simple, requiring only a single HTTP GET request, which explains the near-universal EPSS score. Affected models span the D-Link DCS camera product line including DCS-2530L (firmware up to 1.05.05), DCS-2670L (firmware before 2.03.00), DCS-4603, DCS-4622, DCS-4701E, DCS-4703E, DCS-4705E, DCS-4802E, and DCS-P703. The DCS-P703 is particularly concerning as it has no available patch due to end-of-life status.
Frequently Asked Questions
Is CVE-2020-25078 being actively exploited?
Yes. CVE-2020-25078 is massively exploited through automated scanning. Its EPSS score of 94.15% at the 99th percentile confirms near-universal exploitation. CISA has added it to the KEV catalog with a remediation deadline of August 26, 2025.
What products are affected by CVE-2020-25078?
Multiple D-Link camera models are affected including DCS-2530L, DCS-2670L, DCS-4603, DCS-4622, DCS-4701E, DCS-4703E, DCS-4705E, DCS-4802E, and DCS-P703. Each model has specific firmware version requirements for the fix.
How do I fix CVE-2020-25078?
Apply the latest firmware from D-Link for your specific camera model. Immediately isolate cameras from the internet, change all administrator passwords, and replace end-of-life models that have no available patches.
How severe is CVE-2020-25078?
CVE-2020-25078 has a CVSS v3.1 score of 7.5 (High severity) and the highest possible EPSS percentile (99th), indicating massive automated exploitation. The vulnerability exposes administrator credentials without authentication, enabling full device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.