CVE-2020-25078

HIGH KEV NUCLEI

D-Link DCS-2530L <1.06.01 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-25078 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added August 5, 2025. EIP tracks 3 public exploits from researchers including MzzdToT, flags-alt, chinaYozz. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits an information disclosure vulnerability in D-Link DCS series devices by querying the '/config/getuser?index=0' endpoint to retrieve user credentials. It includes multi-threading for batch scanning and random User-Agent generation to evade detection.

Description

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

Exploits (3)

nomisec WORKING POC 4 stars
by MzzdToT · infoleak
https://github.com/MzzdToT/CVE-2020-25078

This PoC exploits an information disclosure vulnerability in D-Link DCS series devices by querying the '/config/getuser?index=0' endpoint to retrieve user credentials. It includes multi-threading for batch scanning and random User-Agent generation to evade detection.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: D-Link DCS series devices
No auth needed
Prerequisites: Network access to the target device · The '/config/getuser' endpoint must be exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by flags-alt · poc
https://github.com/flags-alt/abyss-c2

The repository contains functional exploit code for CVE-2020-25078, targeting HiSilicon DVR/NVR devices. It includes path traversal techniques to extract sensitive configuration files and credentials, along with additional network exploitation tools.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: HiSilicon Hi3516/Hi3518/Hi3519 based DVR/NVR devices
No auth needed
Prerequisites: Network access to the target device · Target device running vulnerable HiSilicon firmware
devstral-2 · analyzed May 21, 2026 Full analysis →
nomisec WORKING POC
by chinaYozz · remote-auth
https://github.com/chinaYozz/CVE-2020-25078

This PoC exploits CVE-2020-25078, an information disclosure vulnerability in D-Link routers, to extract admin credentials via a crafted HTTP request to the `/config/getuser` endpoint. It reads target IPs from a file, sends requests, and logs extracted credentials.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: D-Link routers (specific version not specified)
No auth needed
Prerequisites: List of target IPs/URLs in `ip.txt`
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure
HIGHby pikpikcu

Scores

CVSS v3 7.5
EPSS 0.9415
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact partial

Details

CISA KEV 2025-08-05
VulnCheck KEV 2021-06-01
InTheWild.io 2021-05-01
ENISA EUVD EUVD-2020-17770
Status published
Products (9)
dlink/dcs-2530l_firmware < 1.05.05
dlink/dcs-2670l_firmware < 2.03.00
dlink/dcs-4603_firmware < 1.04.02
dlink/dcs-4622_firmware < 2.01.10
dlink/dcs-4701e_firmware < 2.03.01
dlink/dcs-4703e_firmware < 1.03.04
dlink/dcs-4705e_firmware < 1.03.02
dlink/dcs-4802e_firmware < 2.01.01
dlink/dcs-p703_firmware
Published Sep 02, 2020
KEV Added Aug 05, 2025
Tracked Since Feb 18, 2026