D-Link DCS-2530L < 1.07 and DCS-2670L < 2.03 Multiple Vulnerabilities

#TRUSTED 88a9caf074ea713e7a3554c06a18125d40fb3abb3c0a0ff246288a541e792050db35b6476d4c9cfa4ad649edbae3b7a0a0688777d2313314d9ba579c39a54fc3787cf1f80c17db8eb5f60d0166f2aed6f0e5ff78b0a39629280f9ba930115672fbd76c2fa78b87dec16ca98337b0b7e26a76098277f38f24a9ae5743911ea82ee6e4ba26059983e3e2b92d57f987a168592c37475dfc164c1b85a21d36d4ab4adb3041893b151ff71bb12db6b3e910c00928c93513e967bd8292297515ab8b012d511208a06ba1a0c6061ef396dda93594e1d07c06b19a5d447429ff9187117438b654547b553b6a3f85d3446743d0b8758878edeb0244e667341c73ed3d89db40db7a504d05a5f0a6d4f4f13851381469b3caa8ce85ad038d24306e86fcd86fbc2c73c9f1eaaef87ec8ed3041afa842c46c5c7982feb46c7e2dcb07f7d8ec973f519db30e3fc31ae85e7c63c8acb4f6b499f815669ff79a9cb4174801226b52d61b3b7ff0c4703449986cf8ac14894dfbedfc61e5e7c926a236da6b9362734bd4cbda81ec4ec7c585d862590dd7eeb408aa33d476d9e721447e6e4a74107dff74efd2423a30962595956b5f6ccf035ac2fa3672281a18d1827a52d0e6e9aa27fcd840543cb49f187c1febecdf7883e53a63cfa1b9753b64573a1b50daad190c23f72011e077e02a3de4faa26383b54864a9aff30151cd6080126476477f0147
#TRUST-RSA-SHA256 4b66fede04681fd21d519f2665711ed49f208a667eb0189f64eafce8f0e60aeedff1e6bfc8965192c00fbc1cbfd0b07424ed34294b3bf97cfe7fbbc6019a1cc8c942592b221d30ca275c3b5bc6e8873a9215956630b0ed3a864ecd8da45f7e99b5e459744f41784944f9bc88a6cda93c246032f34e8131805cc26e9633f74ec32021ac335a86d89ac423c823ee2fd4ea5228ddf7fc9331eadd6c5c1736f4d9d40e9bacb4ed42aabb847f5997d0bc03e65297e50dd70c1cc0aa709a91d1dd649f10c6346463e65c42663620b2b5492e1eeb02f3c614940f839afff384db8ad544aa8042ae3a2cb3dba54a72de19679416708dbeba04a2287b6977b2baf8c65cb65d608661b93e048326f570868f369c855e9709ca6e7ebbc8871a3d5c3566718f0b52baaa753218edd8d9903ce9de09e422689c29309a279dfb34f6862799880c1e6130c6454e7639406167b065d111bbc658589f855b07cd03997ffd26a12a860773e45dae0ce9b430bd67ea6edfd93a4523a6a90d3a1c52ccfaf4f592ae89d7de7902332cc5b7ad7ce96baa83bbdfef143499b17976d3753da1b58598894d61897c0538a8e39f8b8f009cefbae47200832a40b2896a19cb4be7170dfd3c9c6fd2a51a3e0982f70f0e96617c3c40f2c2b8c44400b46f2e459905031da4215556284cce556ece532fd6072c88f68cacc6be82aca250f5a647210adf013eb863b5
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(316488);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/23");

  script_cve_id("CVE-2020-25079", "CVE-2020-25078");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/08/26");

  script_name(english:"D-Link DCS-2530L < 1.07 and DCS-2670L < 2.03 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The IP Camera is affected by a command injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, D-Link IP Camera DCS-2530L on or before 1.05.05, and DCS-2670L on or before 
2.02 are affected by multiple vulnerabilities.

  - A command injection vulnerability exists in affected devices due to the improper neutralization of special 
  elements in cgi-bin/ddns_enc.cgi. An authenticated, remote attacker, can exploit this by manipulating 
  structural command seperators to execute arbitrary commands. (CVE-2020-25079)

  - An authentication bypass vulnerability exists in affected devices due to the /config/getuser endpoint 
  allowing for remote administrator password disclosure. An unauthenticated, remote attacker can exploit this,
  via sending a direct HTTP request, to bypass authentication and execute arbitrary actions with administrative 
  privileges. (CVE-2020-25078)

Note that Nessus has not tested for this issue but has instead relied only on the camera's self-reported model and 
version.");
  # https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e142f957");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor supplied hotfix per affected model, or upgrade to a supported device.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-25079");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/09/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/07/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/22");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dlink:camera");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("d-link_ip_camera_detect.nbin");
  script_require_keys("installed_sw/D-Link IP Camera");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('vcf.inc');

var app = 'D-Link IP Camera';

var detected_on = get_kb_list('installed_sw/*/D-Link IP Camera/Lw$$/version');
if (empty_or_null(detected_on))
  audit(AUDIT_NOT_INST, app);

var port;
foreach var key (keys(detected_on))
{
  var port_match = pregmatch(string:key, pattern:'installed_sw/([0-9]+)/');
  if (!empty_or_null(port_match))
  {
    port = int(port_match[1]);
    break;
  }
}

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var models = {
  'DCS-2530L' : [{ 'max_version' : '1.05.05', 'fixed_version' : '1.07.00'}],
  'DCS-2670L' : [{ 'fixed_version' : '2.03'}]
};

if (empty_or_null(models[app_info['Model']]))
  audit(AUDIT_DEVICE_NOT_VULN, app_info['Model']);

vcf::check_version_and_report(
  app_info:app_info,
  constraints:models[app_info['Model']],
  severity:SECURITY_HOLE
);