CVE-2020-25078

🗓️ 02 Sep 2020 15:33:18Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 336 Views🌐 WEB

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure

Reporter	Title	Published	Views	Family All 30
GithubExploit	Exploit for CVE-2020-25078	15 Oct 202113:03	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	26 May 202613:06	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	20 May 202622:54	–	githubexploit
GithubExploit	Exploit for CVE-2020-25078	26 May 202612:57	–	githubexploit
attackerkb	CVE-2020-25078	2 Sep 202000:00	–	attackerkb
BDU FSTEC	D-Link IP Camera Information Disclosure	6 Oct 202500:00	–	bdu_fstec
Circl	CVE-2020-25078	30 Mar 202109:46	–	circl
CISA KEV Catalog	D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability	5 Aug 202500:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	5 Aug 202512:00	–	cisa
CNVD	D-Link DCS-2530L and DCS-2670L Information Disclosure Vulnerability	3 Sep 202000:00	–	cnvd

NVD

Node

AND

dlink dcs-4603_firmwareRange<1.04.02

dlink dcs-4603Match-

Node

AND

dlink dcs-4622_firmwareRange<2.01.10

dlink dcs-4622Match-

Node

AND

dlink dcs-4701e_firmwareRange<2.03.01

dlink dcs-4701eMatch-

Node

AND

dlink dcs-4703e_firmwareRange<1.03.04

dlink dcs-4703eMatch-

Node

AND

dlink dcs-4705e_firmwareRange<1.03.02

dlink dcs-4705eMatch-

Node

AND

dlink dcs-4802e_firmwareRange<2.01.01

dlink dcs-4802eMatch-

Node

AND

dlink dcs-p703_firmware

dlink dcs-p703Match-

Node

AND

dlink dcs-2530l_firmwareRange≤1.05.05

dlink dcs-2530lMatch-

Node

AND

dlink dcs-2670l_firmwareRange<2.03.00

dlink dcs-2670lMatch-

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
twitter	www.twitter.com/Dogonsecurity/status/1273251236167516161
support	www.support.dlink.com/productinfo.aspx
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
index	query param	/config/getuser?index=0	Unauthenticated credential disclosure via /config/getuser?index=0 (CVE-2020-25078).	CWE-22

17 Jun 2026 03:06Current

7.7High risk

Vulners AI Score7.7

CVSS 25

CVSS 3.17.5

EPSS0.97511

SSVC

In Wild