CVE-2020-25079
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
Description
CVE-2020-25079 is a high-severity command injection vulnerability in D-Link network cameras, specifically the DCS-2530L and DCS-2670L models. The flaw exists in the cgi-bin/ddns_enc.cgi endpoint and allows an authenticated attacker to inject and execute arbitrary operating system commands on the camera's underlying system. With a CVSS v3.1 score of 8.8, this vulnerability requires only low-level authentication and can be exploited remotely over the network. CISA has added CVE-2020-25079 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 26, 2025, and the EPSS score of 48.27% at the 97th percentile confirms extremely high exploitation activity, particularly when chained with CVE-2020-25078 which provides unauthenticated credential disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dcs-4703e firmware | < 1.03.04 |
| dlink | dcs-4705e firmware | < 1.03.02 |
| dlink | dcs-4802e firmware | < 2.01.01 |
| dlink | dcs-p703 firmware | All versions |
| dlink | dcs-4603 firmware | < 1.04.02 |
| dlink | dcs-4622 firmware | < 2.01.10 |
| dlink | dcs-4701e firmware | < 2.03.01 |
| dlink | dcs-2530l firmware | <= 1.05.05 |
| dlink | dcs-2670l firmware | < 2.03.00 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180(Patch, Vendor Advisory)
- https://twitter.com/Dogonsecurity/status/1271265152118259712(Broken Link, Exploit, Third Party Advisory)
- https://support.dlink.com/productinfo.aspx?m=DCS-2530L(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25079(US Government Resource)
Weakness Type
CWE-77: Command Injection
CVE-2020-25079 is classified under CWE-77 (Command Injection), a critical weakness where software constructs commands using external input without properly neutralizing special elements that could modify the intended command. In the D-Link camera's cgi-bin/ddns_enc.cgi endpoint, user-supplied parameters related to Dynamic DNS configuration are incorporated into system commands without sanitization, allowing an attacker to inject shell metacharacters and execute arbitrary commands.
Learn more: CWE-77 — Command Injection
Impact Analysis
CVE-2020-25079 enables complete compromise of affected D-Link cameras. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requiring only low-level authentication (PR:L) and no user interaction (UI:N). Confidentiality (High): command injection allows the attacker to read any data on the camera including video feeds, stored recordings, configuration files, and network credentials. Integrity (High): the attacker can modify camera settings, alter or delete recordings, install persistent malware, and reconfigure the device for malicious purposes. Availability (High): the attacker can disable the camera, corrupt its firmware, or recruit it into a botnet for distributed denial-of-service attacks. The authentication requirement appears significant but is effectively negated when CVE-2020-25079 is combined with CVE-2020-25078, which exposes administrator credentials without authentication on the same devices. This chaining makes the combined attack effectively unauthenticated, dramatically increasing the real-world severity.
Exploit Maturity
CVE-2020-25079 has a highly mature exploit landscape. CISA has confirmed active exploitation by including it in the KEV catalog. The EPSS score of 48.27% at the 97th percentile places this vulnerability among the top 3% most likely to be exploited, indicating widespread targeting by automated tools and botnets. Chaining potential is critical for this vulnerability: when combined with CVE-2020-25078 (unauthenticated admin password disclosure on the same D-Link camera models), the authentication requirement is eliminated entirely, creating an unauthenticated remote code execution chain. The vendor advisory acknowledges the issue, and multiple D-Link camera models across the DCS product line are affected. IoT cameras remain prime targets for botnet recruitment, and the combination of credential disclosure plus command injection provides a reliable, fully automated exploitation pathway.
Remediation
-
Apply firmware updates from D-Link for all affected camera models. Refer to the D-Link Security Advisory SAP10180 for model-specific patched firmware versions. DCS-2530L requires firmware 1.06.01 Hotfix and DCS-2670L requires firmware beyond version 2.02.
-
Isolate cameras from untrusted networks immediately. Place all D-Link cameras behind a firewall or VPN and ensure the management interface is not accessible from the public internet. Given the chaining potential with CVE-2020-25078, internet-exposed cameras should be considered compromised.
-
Change all credentials on affected cameras and ensure strong, unique passwords are used. If CVE-2020-25078 is also present, assume that existing credentials have been harvested and rotate them immediately after applying the firmware update.
-
Replace end-of-life camera models including DCS-P703 and any other models without available patches. Devices that cannot be patched must be decommissioned and replaced with currently supported alternatives.
-
Implement network monitoring to detect command injection exploitation, including monitoring for unusual outbound connections from camera devices, unexpected DNS queries, or traffic patterns indicative of botnet activity. Segment the IoT network to contain any compromise and prevent lateral movement to critical infrastructure.
Technical Details
CVE-2020-25079 is a command injection vulnerability in the cgi-bin/ddns_enc.cgi endpoint of D-Link DCS network cameras. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity, low authentication requirement, and high impact across all CIA dimensions. The vulnerability exists in the Dynamic DNS (DDNS) configuration handler, where user-supplied parameters are passed to system shell commands without proper sanitization. An authenticated user can inject shell metacharacters such as semicolons, backticks, or command substitution sequences into DDNS configuration fields, causing the embedded Linux system to execute attacker-controlled commands with the privileges of the web server process, which typically runs as root on these embedded devices. Affected models include DCS-2530L (firmware up to 1.05.05), DCS-2670L (firmware before 2.03.00), DCS-4603, DCS-4622, DCS-4701E, DCS-4703E, DCS-4705E, DCS-4802E, and DCS-P703. The authentication requirement is effectively bypassed when chained with CVE-2020-25078, making this a critical unauthenticated RCE chain.
Frequently Asked Questions
Is CVE-2020-25079 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2020-25079 to the KEV catalog. The EPSS score of 48.27% at the 97th percentile indicates extremely high exploitation activity. The vulnerability is frequently chained with CVE-2020-25078 for unauthenticated remote code execution.
What products are affected by CVE-2020-25079?
D-Link camera models including DCS-2530L, DCS-2670L, DCS-4603, DCS-4622, DCS-4701E, DCS-4703E, DCS-4705E, DCS-4802E, and DCS-P703 are affected. Each model has specific firmware requirements for the fix.
How do I fix CVE-2020-25079?
Apply the latest firmware from D-Link per Security Advisory SAP10180. Isolate cameras from the internet, change all credentials, and replace end-of-life models without available patches.
How severe is CVE-2020-25079?
CVE-2020-25079 has a CVSS v3.1 score of 8.8 (High severity). When combined with CVE-2020-25078, it enables unauthenticated remote code execution on D-Link cameras, making the effective severity critical.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.