D-Link DCS-2530L/2670L: 2020 Camera Bugs Added to KEV

What to do

1. Inventory IP cameras and flag every D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx and DCS-P703, with hardware revision and firmware version.
2. Remove any port forward or UPnP mapping that exposes a camera's web interface to the internet.
3. Install the hotfix firmware listed in D-Link SAP10180 where one exists, then change the admin password.
4. Replace the DCS-P703 and plan to replace the DCS-2530L, which no longer receives updates.
5. Put cameras on a separate VLAN that cannot reach servers or workstations, as the FBI recommends.

How to check if you are affected or compromised

• Search web, proxy and IDS logs for requests to /config/getuser and /cgi-bin/ddns_enc.cgi, especially from internet addresses.
• Treat any camera that ran old firmware while internet-facing as having a known admin password; check its accounts and DDNS settings for values you did not set.
• Look for unexpected outbound connections from camera addresses, and inbound scans on the ports the FBI lists (23, 26, 554, 2323, 567, 5523, 8080, 9530, 56575).

What happened#

On June 11, 2020, according to the first version of D-Link's advisory, a researcher publicly disclosed two zero-days in the DCS-2530L, a consumer Wi-Fi camera. The first bug, CVE-2020-25078, is an unauthenticated /config/getuser endpoint that hands out the administrator password. The second, CVE-2020-25079, is a command injection in cgi-bin/ddns_enc.cgi that requires a login. Both CVEs were published on September 2, 2020. NVD scores them 7.5 and 8.8.

Together, the pair amounts to a takeover with no credentials. The first bug supplies the password that the second needs. CISA's enrichment rates the password leak as automatable.

D-Link's current SAP10180 grew to cover more models after Qihoo 360 reported on August 28, 2020 that the flaw reached other cameras. Hotfixes followed through May 2021.

On August 5, 2025, CISA added both CVEs to the KEV catalog (CVE-2020-25078, CVE-2020-25079) with an August 26 deadline. The entries say the products may be end-of-life and tell users to stop using them.

Who is affected#

Per SAP10180: DCS-2530L v1.05.05 and older (fixed in v1.07.00 Hotfix through the mydlink app) and DCS-2670L v2.02 and older (fixed in v2.03.00 Hotfix). Six business models in the DCS-46xx, 47xx and 48xx series also received hotfixes. The non-US DCS-P703 is end of service life and will not be fixed. D-Link's DCS-2530L support page says technical support ended on September 17, 2021. D-Link has not published an end-of-support date for the non-US DCS-2670L as of Oct 23, 2026.

Do you really need to act?#

If you own these cameras, yes. CISA has not said what evidence led to the 2025 listing. The clearest public signal is older. An FBI notice from December 16, 2024 says HiatusRAT actors scanned web cameras and DVRs in the US, Australia, Canada, New Zealand and the UK in March 2024. They looked for CVE-2020-25078 among other bugs and used Ingram, an open-source webcam scanner whose project lists this CVE. The FBI describes scanning and "interest," not confirmed D-Link compromises. The Hacker News noted that no exploitation details were public when CISA acted.

Real exposure is cameras whose web interface is reachable from the internet. That includes small offices and remote workers' homes. A camera on an isolated VLAN with patched firmware is low risk. An unpatched camera with a port forward should be treated as compromised.

What to do now#

1. List every DCS camera with its hardware revision and firmware version, from the device web page or the mydlink app.
2. Remove port forwards and UPnP mappings to cameras. Check with nmap -Pn -p 80,443,8080 <public-range>.
3. Install the SAP10180 hotfix where one exists, then set a new admin password.
4. Retire the DCS-P703, and schedule replacement of the unsupported DCS-2530L.
5. Follow the FBI's advice to isolate cameras from the rest of the network.

How to tell if you were hit#

Search web, proxy and IDS logs for requests to /config/getuser and /cgi-bin/ddns_enc.cgi. On each camera, look for admin changes and DDNS settings you did not make. Watch for unexpected outbound traffic from camera addresses. If an old camera was exposed, reset it to factory defaults before patching or replacing it.

Timeline#

• Jun 11, 2020 — Zero-days in the DCS-2530L are disclosed publicly, per D-Link.
• Jul 26, 2020 — Last update to the DCS-2670L hotfix entry.
• Sep 2, 2020 — CVE-2020-25078 and CVE-2020-25079 are published.
• May 7, 2021 — D-Link lists v1.07.00 Hotfix for the DCS-2530L and hotfixes for the DCS-4xxx models.
• Sep 17, 2021 — DCS-2530L support ends.
• Dec 16, 2024 — FBI reports HiatusRAT scanning for CVE-2020-25078.
• Aug 5, 2025 — CISA adds both CVEs to KEV.

Vulnerability records

• CVE-2020-25078 · KEV 2025-08-05 · An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
• CVE-2020-25079 · KEV 2025-08-05 · An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. D-Link — SAP10180: DCS-2530L, DCS-2670L, DCS-P703 and DCS-46xx/47xx/48xx authenticated command injection and unauthenticated credential disclosure supportannouncement.us.dlink.com
2. D-Link — SAP10180 as first published (archived Aug 5, 2020) web.archive.org
3. D-Link — DCS-2530L support page support.dlink.com
4. CVE record — CVE-2020-25078 cve.org
5. CVE record — CVE-2020-25079 cve.org
6. NVD — CVE-2020-25078 nvd.nist.gov
7. NVD — CVE-2020-25079 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2020-25078 cisa.gov
9. CISA — Known Exploited Vulnerabilities: CVE-2020-25079 cisa.gov
10. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug 5, 2025) cisa.gov
11. FBI — PIN 20241216-001: HiatusRAT Actors Targeting Web Cameras and DVRs ic3.gov
12. GitHub — Ingram webcam scanning tool github.com

Coverage and analysis

1. The Hacker News — CISA Adds 3 D-Link Flaws to KEV thehackernews.com