# CVE-2020-25079

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

- Page: https://www.vulneraibility.com/cve/CVE-2020-25079
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-08-05; CISA due date 2025-08-26
- EPSS: 54.01%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-08-05)
- Weakness: CWE-77
- Published: 2020-09-02

## Affected

- dlink:dcs-4703e_firmware
- dlink:dcs-4705e_firmware
- dlink:dcs-4802e_firmware
- dlink:dcs-p703_firmware
- dlink:dcs-4603_firmware
- dlink:dcs-4622_firmware
- dlink:dcs-4701e_firmware
- dlink:dcs-2530l_firmware
- dlink:dcs-2670l_firmware

## References

- [other] https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180
- [other] https://twitter.com/Dogonsecurity/status/1271265152118259712
- [other] https://support.dlink.com/productinfo.aspx?m=DCS-2530L
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25079

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.