Actively exploited in the wild

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

D-Link - DCS-2530L and DCS-2670L Devices · Listed in the CISA KEV since 2025-08-05. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2020-25079

HighCVSS 8.8KEV

Published: 02/09/2020(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The cgi-bin/ddns_enc.cgi endpoint allows authenticated command injection.

Risk Assessment

An authenticated attacker could execute arbitrary system commands on the device, potentially leading to camera compromise.

Recommendation

Update D-Link DCS-2530L firmware to 1.06.01 Hotfix or later, and DCS-2670L to a version later than 2.02.

Other vulnerabilities in D-Link DCS-2530L, DCS-2670L

CVE-2020-25078HighActively exploited
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

Original NVD description (English source)

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.