Vulnerability Details CVE-2020-25079
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.419
EPSS Ranking 97.3%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
Proposed Action
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Ransomware Campaign
Unknown
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- https://twitter.com/Dogonsecurity/status/1271265152118259712
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- https://twitter.com/Dogonsecurity/status/1271265152118259712
- https://support.dlink.com/productinfo.aspx?m=DCS-2530L
Products affected by CVE-2020-25079
-
cpe:2.3:h:dlink:dcs-2530l:-
-
cpe:2.3:h:dlink:dcs-2670l:-
-
cpe:2.3:h:dlink:dcs-4603:-
-
cpe:2.3:h:dlink:dcs-4622:-
-
cpe:2.3:h:dlink:dcs-4701e:-
-
cpe:2.3:h:dlink:dcs-4703e:-
-
cpe:2.3:h:dlink:dcs-4705e:-
-
cpe:2.3:h:dlink:dcs-4802e:-
-
cpe:2.3:h:dlink:dcs-p703:-
-
cpe:2.3:o:dlink:dcs-2530l_firmware:-
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.00.21
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.03.01
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.04.01
-
cpe:2.3:o:dlink:dcs-2530l_firmware:1.05.05
-
cpe:2.3:o:dlink:dcs-2670l_firmware:-
-
cpe:2.3:o:dlink:dcs-2670l_firmware:1.10
-
cpe:2.3:o:dlink:dcs-2670l_firmware:2.01
-
cpe:2.3:o:dlink:dcs-2670l_firmware:2.02
-
cpe:2.3:o:dlink:dcs-4603_firmware:*
-
cpe:2.3:o:dlink:dcs-4622_firmware:*
-
cpe:2.3:o:dlink:dcs-4701e_firmware:*
-
cpe:2.3:o:dlink:dcs-4703e_firmware:*
-
cpe:2.3:o:dlink:dcs-4705e_firmware:*
-
cpe:2.3:o:dlink:dcs-4802e_firmware:*
-
cpe:2.3:o:dlink:dcs-p703_firmware:*