CVE-2020-25078

Description

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

References

https://www.infosecurity-magazine.com/news/webcams-vulnerable-hiatusrat-fbi/

https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html

https://www.bleepingcomputer.com/news/security/fbi-spots-hiatusrat-malware-attacks-targeting-web-cameras-dvrs/

https://twitter.com/Dogonsecurity/status/1273251236167516161

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3