D-Link DCS-2530L and DCS-2670L IP Cameras Unauthenticated Administrator Password Disclosure (CVE-2020-25078) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-25078) is a critical information disclosure flaw in the web management interface of D-Link DCS-2530L and DCS-2670L IP cameras. The root cause lies in the lack of proper authentication and access control checks on the /config/getuser endpoint. Because the web server fails to validate whether the requesting client possesses valid administrative session tokens, any HTTP request directed to this endpoint is processed without restriction.

2. Exploitation Mechanics & Attack Scenario

An attacker scans the internet for exposed D-Link IP camera web interfaces (typically on port 80 or 8080). Once a target is identified, the attacker sends a direct HTTP GET request to the /config/getuser URI. Due to the missing authentication check, the device's web server responds with the system's user configuration details, exposing the administrator username and password in plaintext or easily reversible formats. This vulnerability has been actively exploited in the wild and is cataloged in CISA's Known Exploited Vulnerabilities (KEV) list, often targeted by automated IoT botnets.

3. Infrastructure & Business Impact

Compromise of the administrator credentials allows unauthorized actors to view live video feeds, violating physical security and privacy policies. Furthermore, attackers can leverage administrative access to flash malicious firmware, recruit the device into IoT botnets (such as Mirai or Gafgyt) for launching distributed denial-of-service (DDoS) attacks, or use the compromised device as a pivot point to penetrate the internal corporate network.