CVE-2020-25079

What Are the D-Link DCS-2530L and DCS-2670L?

The DCS-2530L and DCS-2670L are end-of-life D-Link consumer/small-business IP cameras from the mydlink cloud camera line — see CVE-2020-25078 (also enriched on this site) for the companion password-disclosure vulnerability on the same models.

Overview

CVE-2020-25079 is a command injection vulnerability (CWE-77) in the cgi-bin/ddns_enc.cgi component of the camera's web management interface, allowing a low-privileged attacker to inject and execute arbitrary operating system commands (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Combined with CVE-2020-25078, an attacker can obtain the admin password and then use it to reach this command injection point for full device compromise.

Technical Details

The ddns_enc.cgi script, part of the camera's dynamic DNS configuration functionality, passes user-supplied input into a system-level command without adequate sanitization, allowing shell metacharacters in a request parameter to be interpreted as additional commands rather than data.

Discovery

Publicly tracked via D-Link's security advisory SAP10180, covering this and related vulnerabilities across the affected camera models.

Exploitation Context

As with its companion CVE, CISA added this to KEV in August 2025, five years after original disclosure, reflecting continued deployment of these unsupported end-of-life cameras and their attractiveness to IoT botnet operators given the simplicity and severity of the exploitation primitive.

Remediation

1. Discontinue use of the DCS-2530L and DCS-2670L and replace with a currently supported, patched camera model — no fix is coming for these end-of-life devices.
2. If immediate replacement isn't possible, fully isolate the camera from the internet on a segregated local network segment.
3. Treat this vulnerability together with CVE-2020-25078 as a single compromise chain — password disclosure followed by command injection — when assessing risk.
4. Audit your network for any other end-of-life D-Link IoT devices given this vendor's recurring pattern of unpatched post-support vulnerabilities.