Vulnerability Details CVE-2020-25078
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.943
EPSS Ranking 99.9%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
Proposed Action
D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Ransomware Campaign
Unknown
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- https://twitter.com/Dogonsecurity/status/1273251236167516161
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- https://twitter.com/Dogonsecurity/status/1273251236167516161
- https://support.dlink.com/productinfo.aspx?m=DCS-2530L
Products affected by CVE-2020-25078
-
cpe:2.3:h:dlink:dcs-2530l:-
-
cpe:2.3:h:dlink:dcs-2670l:-
-
cpe:2.3:h:dlink:dcs-4603:-
-
cpe:2.3:h:dlink:dcs-4622:-
-
cpe:2.3:h:dlink:dcs-4701e:-
-
cpe:2.3:h:dlink:dcs-4703e:-
-
cpe:2.3:h:dlink:dcs-4705e:-
-
cpe:2.3:h:dlink:dcs-4802e:-
-
cpe:2.3:h:dlink:dcs-p703:-
-
cpe:2.3:o:dlink:dcs-2530l_firmware:-
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.00.21
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.03.01
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.04.01
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.05.05
-
cpe:2.3:o:dlink:dcs-2670l_firmware:-
-
cpe:2.3:o:dlink:dcs-2670l_firmware:1.10
-
cpe:2.3:o:dlink:dcs-2670l_firmware:2.01
-
cpe:2.3:o:dlink:dcs-2670l_firmware:2.02
-
cpe:2.3:o:dlink:dcs-4603_firmware:*
-
cpe:2.3:o:dlink:dcs-4622_firmware:*
-
cpe:2.3:o:dlink:dcs-4701e_firmware:*
-
cpe:2.3:o:dlink:dcs-4703e_firmware:*
-
cpe:2.3:o:dlink:dcs-4705e_firmware:*
-
cpe:2.3:o:dlink:dcs-4802e_firmware:*
-
cpe:2.3:o:dlink:dcs-p703_firmware:*