erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: June 11, 2020

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: D-Link DCS-2530L/2670L: 2020 Camera Bugs Added to KEV. Anyone running D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx or DCS-P703 cameras, most urgently if a camera's web interface is reachable from the internet.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2020-25078, CVE-2020-25079

D-Link DCS-2530L/2670L: 2020 Camera Bugs Added to KEV

Hotfixes have existed since 2020-2021, but the DCS-2530L is out of support and these cameras are being scanned for; find any that remain, take them off the internet, and update or replace them.

Must act: Anyone running D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx or DCS-P703 cameras, most urgently if a camera's web interface is reachable from the internet.

Can relax: Organizations with none of these camera models, or whose cameras sit on an isolated VLAN with no inbound internet access and run the hotfix firmware.

  1. Inventory IP cameras and flag every D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx and DCS-P703, with hardware revision and firmware version.
  2. Remove any port forward or UPnP mapping that exposes a camera's web interface to the internet.
  3. Install the hotfix firmware listed in D-Link SAP10180 where one exists, then change the admin password.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.