CVE-2020-25078 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2020-09-02

Added to CISA KEV: 2025-08-05 1798 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update D-Link DCS-2530L to version 1.06.01 Hotfix or later
Replace D-Link DCS-2670L devices (no patch available for versions through 2.02)
Implement network segmentation to isolate cameras from direct internet access
Deploy cameras behind VPN or secure remote access solutions
Monitor for unauthorized access attempts to /config/getuser endpoint
Change all default and current administrator passwords immediately
Patch priority: CRITICAL - immediate action required

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2020-25078 is a high-severity information disclosure vulnerability affecting certain D-Link DCS series cameras ^[2]. It is officially recognized in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog, indicating it has been actively exploited in the wild ^[1].

Technical Details and Exploitation

Attack Method: The vulnerability exists in the `/config/getuser` endpoint of the affected devices ^[1].
Requirements: Exploitation is unauthenticated and network-based, meaning an attacker does not need prior access or user interaction to trigger the flaw ^[1].
Impact: Successful exploitation allows a remote attacker to disclose the administrator password for the device, granting them unauthorized administrative access ^[1] ^[2].

Affected Products and Mitigation

The following device versions are known to be affected:

D-Link DCS-2530L: Versions before 1.06.01 Hotfix ^[1].
D-Link DCS-2670L: Versions through 2.02 ^[1].

Users of these devices are advised to consult CISA’s Binding Operational Directive (BOD) 22-01 and the Known Exploited Vulnerabilities Catalog for specific remediation requirements and guidance ^[1]. Generally, applying the latest available firmware updates provided by the manufacturer is the primary mitigation strategy.

Sources