CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

97.51% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-08-05

Nuclei

high

Published

2020-09-02

Updated

2025-10-21

Proof-of-concept exploits (3)

• MzzdToT/CVE-2020-250784★ · 2021-03-30
• antx-code/pocx17★ · 2023-07-04
• chinaYozz/CVE-2020-250780★ · 2021-10-15

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25078.yaml

Exploit collections (3)

• dlink-cve-2020-25078-account-disclosure.ymlchaitin/xray
• D-Link DCS系列监控 账号密码信息泄露 CVE-2020-25078.mdtzwlhack/Vulnerability
• CVE-2020-25078.yamlzan8in/afrog

Security advisories

• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
• https://twitter.com/Dogonsecurity/status/1273251236167516161
• https://support.dlink.com/productinfo.aspx?m=DCS-2530L

References

• CVE Record
• NVD entry

Related

• CVE-2023-28432
• CVE-2021-22205
• CVE-2021-22214
• CVE-2021-26084
• CVE-2021-31166
• CVE-2021-35587