CVE-2020-25078
Last modified
CVE-2020-25078 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.. CISA has confirmed active exploitation in the wild. EPSS estimates a 97.90% chance of exploitation in the next 30 days.
Description
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dlink | Dcs-4603 Firmware | < 1.04.02 |
| Dlink | Dcs-4622 Firmware | < 2.01.10 |
| Dlink | Dcs-4701e Firmware | < 2.03.01 |
| Dlink | Dcs-4703e Firmware | < 1.03.04 |
| Dlink | Dcs-4705e Firmware | < 1.03.02 |
| Dlink | Dcs-4802e Firmware | < 2.01.01 |
| Dlink | Dcs-P703 Firmware | All versions |
| Dlink | Dcs-2530l Firmware | <= 1.05.05 |
| Dlink | Dcs-2670l Firmware | < 2.03.00 |
References
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180Patch, Vendor Advisory
- https://twitter.com/Dogonsecurity/status/1273251236167516161Broken Link, Third Party Advisory
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180Patch, Vendor Advisory
- https://twitter.com/Dogonsecurity/status/1273251236167516161Broken Link, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2020-25078?
How severe is CVE-2020-25078?
How do I fix CVE-2020-25078?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-25069USVN (aka User-friendly SVN) before 1.0.10 allows attackers …9.8
- CVE-2020-2507The vulnerability have been reported to affect earlier versi…9.8
- CVE-2020-25070USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, rela…8.8
- CVE-2020-25071Nifty Project Management Web Application 2020-08-26 allows X…5.4
- CVE-2020-25073FreedomBox through 20.13 allows remote attackers to obtain s…5.3
- CVE-2020-25074The cache action in action/cache.py in MoinMoin through 1.9.…9.8
- CVE-2020-25079An issue was discovered on D-Link DCS-2530L before 1.06.01 H…8.8
- CVE-2020-2508A command injection vulnerability has been reported to affec…7.2
- CVE-2020-25082An attacker with physical access to Nuvoton Trusted Platform…3.8
- CVE-2020-25084QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because…3.2
- CVE-2020-25085QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read…5
- CVE-2020-25086Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
Are you affected by CVE-2020-25078?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST