Actively exploited in the wild
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability
D-Link - DCS-2530L and DCS-2670L Devices · Listed in the CISA KEV since 2025-08-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2020-25078
HighCVSS 7.5KEVSummary
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Risk Assessment
An unauthenticated attacker could obtain the administrator password, leading to full device compromise.
Recommendation
Update D-Link DCS-2530L firmware to 1.06.01 Hotfix or later, and DCS-2670L to a version later than 2.02.
Other vulnerabilities in D-Link DCS-2530L, DCS-2670L
Original NVD description (English source)
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.