Sign-up

ID

VAR-202009-0782


CVE

CVE-2020-25078


TITLE

D-Link DCS-2530L and DCS-2670L information disclosure vulnerabilities

Trust: 0.6

sources: CNVD: CNVD-2020-52375

DESCRIPTION

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure. DCS-2530L and DCS-2670L are full HD 180 degree Wi-Fi cameras launched by D-Link. The cgi-bin/ddns_enc.cgi in D-Link DCS-2530L and DCS-2670L has security vulnerabilities

Trust: 1.53

sources: NVD: CVE-2020-25078 // CNVD: CNVD-2020-52375 // VULMON: CVE-2020-25078

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-52375

AFFECTED PRODUCTS

vendor:dlinkmodel:dcs-2670lscope:lteversion:2.02

Trust: 1.0

vendor:dlinkmodel:dcs-2530lscope:lteversion:1.05.05

Trust: 1.0

vendor:d linkmodel:dcs-2530l hotfixscope:ltversion:1.06.01

Trust: 0.6

vendor:d linkmodel:dcs-2670lscope:lteversion:<=2.02

Trust: 0.6

sources: CNVD: CNVD-2020-52375 // NVD: CVE-2020-25078

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-25078
value: HIGH

Trust: 1.0

CNVD: CNVD-2020-52375
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202009-083
value: HIGH

Trust: 0.6

VULMON: CVE-2020-25078
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-25078
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2020-52375
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-25078
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2020-52375 // VULMON: CVE-2020-25078 // CNNVD: CNNVD-202009-083 // NVD: CVE-2020-25078

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2020-25078

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202009-083

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202009-083

PATCH

title:Patch for D-Link DCS-2530L and DCS-2670L information disclosure vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/234286

Trust: 0.6

title:D-Link DCS-2530L and DCS-2670L Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=127368

Trust: 0.6

title: - url:https://github.com/chinaYozz/CVE-2020-25078

Trust: 0.1

sources: CNVD: CNVD-2020-52375 // VULMON: CVE-2020-25078 // CNNVD: CNNVD-202009-083

EXTERNAL IDS

db:NVDid:CVE-2020-25078

Trust: 2.3

db:DLINKid:SAP10180

Trust: 1.6

db:CNVDid:CNVD-2020-52375

Trust: 0.6

db:NSFOCUSid:50623

Trust: 0.6

db:CNNVDid:CNNVD-202009-083

Trust: 0.6

db:VULMONid:CVE-2020-25078

Trust: 0.1

sources: CNVD: CNVD-2020-52375 // VULMON: CVE-2020-25078 // CNNVD: CNNVD-202009-083 // NVD: CVE-2020-25078

REFERENCES

url:https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10180

Trust: 1.6

url:https://twitter.com/dogonsecurity/status/1273251236167516161

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-25078

Trust: 1.2

url:http://www.nsfocus.net/vulndb/50623

Trust: 0.6

sources: CNVD: CNVD-2020-52375 // CNNVD: CNNVD-202009-083 // NVD: CVE-2020-25078

SOURCES

db:CNVDid:CNVD-2020-52375
db:VULMONid:CVE-2020-25078
db:CNNVDid:CNNVD-202009-083
db:NVDid:CVE-2020-25078

LAST UPDATE DATE

2024-11-23T22:33:18.570000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-52375date:2020-09-16T00:00:00
db:VULMONid:CVE-2020-25078date:2023-11-08T00:00:00
db:CNNVDid:CNNVD-202009-083date:2021-01-04T00:00:00
db:NVDid:CVE-2020-25078date:2024-11-21T05:17:12.850

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-52375date:2020-09-16T00:00:00
db:VULMONid:CVE-2020-25078date:2020-09-02T00:00:00
db:CNNVDid:CNNVD-202009-083date:2020-09-02T00:00:00
db:NVDid:CVE-2020-25078date:2020-09-02T16:15:12.627