CVE-2020-25078

What Are the D-Link DCS-2530L and DCS-2670L?

The DCS-2530L and DCS-2670L are consumer/small-business IP cameras from D-Link's mydlink cloud camera line, designed for home and small-office surveillance with remote viewing over the internet. Both models have reached end-of-life and end-of-service status, meaning D-Link no longer ships security patches for them — a common and recurring problem across the consumer IoT camera market, where devices remain deployed and internet-connected for years after the vendor stops supporting them.

Overview

CVE-2020-25078 allows an unauthenticated remote attacker to obtain the device's administrator password (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High). Because the affected models are end-of-life, D-Link's own guidance is to discontinue use of the product rather than expect a fix — there is no patch coming.

Technical Details

The vulnerability allows the administrator credential to be disclosed to an unauthenticated network attacker through the camera's web management interface, without requiring any prior access or authentication. Combined with the related command injection vulnerability on the same devices (CVE-2020-25079, also enriched on this site), an attacker can chain credential disclosure with direct command execution for full device compromise.

Discovery

Publicly tracked via D-Link's security advisory SAP10180, covering multiple vulnerabilities across this camera model line.

Exploitation Context

CISA added this CVE to KEV in August 2025 — five years after original disclosure — reflecting a long tail of these end-of-life cameras still deployed and internet-facing, and newly confirmed active exploitation likely tied to IoT botnet recruitment given how simple and reliable the exploitation primitive is (unauthenticated password disclosure).

Remediation

1. Discontinue use of the DCS-2530L and DCS-2670L and replace with a currently supported camera model — D-Link's own guidance is that no fix is coming for these end-of-life devices.
2. If replacement isn't immediately possible, isolate the camera from the internet entirely, restricting it to a local network segment with no inbound or outbound internet access.
3. Change default credentials is not sufficient mitigation — since the vulnerability discloses whatever the current administrator password is, not just a default value.
4. Audit your network for any other end-of-life D-Link camera models still in service, since this vendor's IoT camera line has a recurring pattern of unpatched vulnerabilities once support ends.