CVE-2020-25078
CVE-2020-25078
In short
A security flaw in D-Link cameras allows anyone on the network to view the administrator password without logging in. This is dangerous because attackers can then take complete control of the camera and the network it protects.
Technical detail
An unauthenticated information disclosure vulnerability exists in the /config/getuser endpoint of D-Link DCS-2530L and DCS-2670L devices. A remote attacker can access this endpoint without authentication to retrieve administrator credentials, leading to complete device compromise and potential lateral movement within the network.
Summary generated and translated by AI from the official description.
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/apublic PoCs found — 3
githubgithub.com/MzzdToT/CVE-2020-25078★ 4githubgithub.com/chinaYozz/CVE-2020-25078★ 0githubgithub.com/flags-alt/abyss-c2★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →