CVE-2020-25078

🗓️ 02 Sep 2020 15:33:18Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 261 Views🌐 WEB

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for CVE-2020-25078	15 Oct 202113:03	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	26 May 202613:06	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	20 May 202622:54	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	26 May 202612:57	–	githubexploit
ATTACKERKB	CVE-2020-25078	2 Sep 202000:00	–	attackerkb
Circl	CVE-2020-25078	30 Mar 202109:46	–	circl
CISA KEV Catalog	D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability	5 Aug 202500:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	5 Aug 202512:00	–	cisa
CNVD	D-Link DCS-2530L and DCS-2670L Information Disclosure Vulnerability	3 Sep 202000:00	–	cnvd
Cvelist	CVE-2020-25078	2 Sep 202015:33	–	cvelist

NVD

Node

dlink dcs-4603_firmwareRange<1.04.02

AND

dlink dcs-4603Match-

Node

dlink dcs-4622_firmwareRange<2.01.10

AND

dlink dcs-4622Match-

Node

dlink dcs-4701e_firmwareRange<2.03.01

AND

dlink dcs-4701eMatch-

Node

dlink dcs-4703e_firmwareRange<1.03.04

AND

dlink dcs-4703eMatch-

Node

dlink dcs-4705e_firmwareRange<1.03.02

AND

dlink dcs-4705eMatch-

Node

dlink dcs-4802e_firmwareRange<2.01.01

AND

dlink dcs-4802eMatch-

Node

dlink dcs-p703_firmware

AND

dlink dcs-p703Match-

Node

dlink dcs-2530l_firmwareRange≤1.05.05

AND

dlink dcs-2530lMatch-

Node

dlink dcs-2670l_firmwareRange<2.03.00

AND

dlink dcs-2670lMatch-

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
twitter	www.twitter.com/Dogonsecurity/status/1273251236167516161
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
support	www.support.dlink.com/productinfo.aspx

Parameter	Position	Path	Description	CWE
config/getuser	path	xxx.xxx.xxx.xxx:80/config/getuser	Unauthenticated endpoint exposing administrator credentials via path traversal vulnerability	CWE-22
config/getuser	path	xxx.xxx.xxx.xxx:443/config/getuser	Unauthenticated endpoint exposing administrator credentials via path traversal vulnerability	CWE-22

07 Nov 2025 22:02Current

7.7High risk

Vulners AI Score7.7

CVSS 25

CVSS 3.17.5

EPSS0.94146

SSVC

In Wild