Remote Administrator Password Disclosure in D-Link Security Cameras
CVE-2020-25078
7.5HIGH
Key Information:
- Vendor
- D-Link
- Status
- Vendor
- CVE Published:
- 2 September 2020
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 90%
Summary
A vulnerability exists in D-Link DCS-2530L (versions prior to 1.06.01 Hotfix) and DCS-2670L (versions up to 2.02) security cameras that allows an attacker to exploit the /config/getuser endpoint. This exploit can lead to the unauthorized disclosure of the administrator password without requiring authentication, putting sensitive information at risk and enabling potential unauthorized access to the device's administrative features.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
90% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved