# CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

- Page: https://www.vulneraibility.com/cve/CVE-2020-25078
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2025-08-05; CISA due date 2025-08-26
- EPSS: 97.51%
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept · 1 Nuclei template (first 2021-03-30)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-08-05)
- Published: 2020-09-02

## Affected

- dlink:dcs-4603_firmware
- dlink:dcs-4622_firmware
- dlink:dcs-4701e_firmware
- dlink:dcs-4703e_firmware
- dlink:dcs-4705e_firmware
- dlink:dcs-4802e_firmware
- dlink:dcs-p703_firmware
- dlink:dcs-2530l_firmware
- dlink:dcs-2670l_firmware

## References

- [other] https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- [other] https://twitter.com/Dogonsecurity/status/1273251236167516161
- [other] https://support.dlink.com/productinfo.aspx?m=DCS-2530L
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.