CVE-2020-25078 in DCS-2530L
Summary
by MITRE
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/23/2026
The vulnerability identified as CVE-2020-25078 affects D-Link network camera models DCS-2530L and DCS-2670L, representing a critical authentication bypass flaw that exposes administrative credentials to unauthenticated attackers. This issue stems from improper access control implementation within the device's web interface, specifically targeting the /config/getuser endpoint which should require valid authentication credentials to access user configuration data. The vulnerability exists in firmware versions prior to 1.06.01 Hotfix for DCS-2530L and through version 2.02 for DCS-2670L, indicating a widespread exposure across multiple device generations and firmware releases.
The technical flaw manifests through the lack of authentication checks on the /config/getuser endpoint, which is designed to retrieve user account information including administrative credentials. This endpoint should enforce strict authentication mechanisms to prevent unauthorized access to sensitive configuration data, yet it remains accessible to any remote attacker without requiring valid login credentials. The vulnerability directly maps to CWE-284, which describes improper access control, and represents a classic case of insufficient authentication validation where the system fails to properly verify the identity of requesting entities before granting access to privileged information. The exposed administrative credentials could provide attackers with complete control over the affected devices, enabling them to modify configurations, access video feeds, and potentially compromise the entire network infrastructure.
The operational impact of this vulnerability is severe and far-reaching, as it allows remote attackers to obtain administrative passwords without any prior authentication or exploitation attempts. Once an attacker gains access to these credentials, they can fully compromise the affected devices and use them as entry points for further network infiltration. The vulnerability creates a persistent threat vector that remains active until the affected devices receive proper firmware updates, making it particularly dangerous for organizations relying on these cameras for security monitoring. Attackers can leverage this vulnerability to establish persistent backdoors, modify device settings, disable security features, and potentially use the compromised cameras as pivoting points for attacking other network components. This type of vulnerability directly aligns with ATT&CK technique T1078.004, which covers legitimate credentials and default credentials, and represents a significant risk to both physical and network security posture.
Mitigation strategies for CVE-2020-25078 require immediate firmware updates from D-Link to address the authentication bypass vulnerability, with administrators prioritizing the installation of the latest firmware versions that include proper access control measures for the affected endpoints. Network segmentation should be implemented to isolate these devices from critical network segments, while firewall rules should be configured to restrict access to the affected devices to only trusted IP addresses and networks. Additionally, organizations should consider implementing network monitoring solutions to detect unusual access patterns or attempts to query the vulnerable /config/getuser endpoint, and conduct regular vulnerability assessments to identify similar authentication bypass issues across their network infrastructure. The remediation process should also include changing administrative passwords on all affected devices, as the vulnerability allows for password disclosure rather than password reset, making it essential to proactively update credentials even after firmware updates are applied.