---
title: "D-Link DCS-2530L/2670L: 2020 Camera Bugs Added to KEV"
url: https://erroneo.us/security/briefs/d-link-dcs-2530l-2670l-cve-2020-25078-25079-camera-flaws/
description: "Unauthenticated admin-password leak plus command injection in D-Link DCS cameras, fixed by 2020-2021 hotfixes, joined KEV in Aug 2025. Update or retire."
type: security-brief
section: "Security Digest"
date_published: 2020-06-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2020-25078", "CVE-2020-25079"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# D-Link DCS-2530L/2670L: 2020 Camera Bugs Added to KEV

**Verdict: Check exposure.** Hotfixes have existed since 2020-2021, but the DCS-2530L is out of support and these cameras are being scanned for; find any that remain, take them off the internet, and update or replace them.

- **Who must act:** Anyone running D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx or DCS-P703 cameras, most urgently if a camera's web interface is reachable from the internet.
- **Who can relax:** Organizations with none of these camera models, or whose cameras sit on an isolated VLAN with no inbound internet access and run the hotfix firmware.
- **Affected:** DCS-2530L (all Ax revisions) v1.05.05 and older; DCS-2670L (all Ax revisions) v2.02 and older; DCS-4603 v1.03.04 and older; DCS-4622 v2.00.04 and older; DCS-4701E v2.00.21 and older; DCS-4703E v1.02.03 and older; DCS-4705E v1.01.00 and older; DCS-4802E v2.00.09 and older; DCS-P703 (non-US, end of service life, no fix)
- **Fixed:** DCS-2530L v1.07.00 Hotfix (via the mydlink app); support ended Sep 17, 2021; DCS-2670L v2.03.00 Hotfix; DCS-4603 v1.04.02, DCS-4622 v2.01.10, DCS-4701E v2.03.01, DCS-4703E v1.03.04, DCS-4705E v1.03.02, DCS-4802E v2.01.01 hotfixes; DCS-P703: none, retire and replace
- **CVEs:** CVE-2020-25078, CVE-2020-25079
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory IP cameras and flag every D-Link DCS-2530L, DCS-2670L, DCS-46xx/47xx/48xx and DCS-P703, with hardware revision and firmware version.
2. Remove any port forward or UPnP mapping that exposes a camera's web interface to the internet.
3. Install the hotfix firmware listed in D-Link SAP10180 where one exists, then change the admin password.
4. Replace the DCS-P703 and plan to replace the DCS-2530L, which no longer receives updates.
5. Put cameras on a separate VLAN that cannot reach servers or workstations, as the FBI recommends.

### How to check if you are affected

- Search web, proxy and IDS logs for requests to /config/getuser and /cgi-bin/ddns_enc.cgi, especially from internet addresses.
- Treat any camera that ran old firmware while internet-facing as having a known admin password; check its accounts and DDNS settings for values you did not set.
- Look for unexpected outbound connections from camera addresses, and inbound scans on the ports the FBI lists (23, 26, 554, 2323, 567, 5523, 8080, 9530, 56575).

## What happened

On June 11, 2020, according to the [first version of D-Link's advisory](https://web.archive.org/web/20200805160139/https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180), a researcher publicly disclosed two zero-days in the DCS-2530L, a consumer Wi-Fi camera. The [first bug, CVE-2020-25078](https://www.cve.org/CVERecord?id=CVE-2020-25078), is an unauthenticated `/config/getuser` endpoint that hands out the administrator password. The [second, CVE-2020-25079](https://www.cve.org/CVERecord?id=CVE-2020-25079), is a command injection in `cgi-bin/ddns_enc.cgi` that requires a login. Both CVEs were published on September 2, 2020. NVD scores them [7.5](https://nvd.nist.gov/vuln/detail/CVE-2020-25078) and [8.8](https://nvd.nist.gov/vuln/detail/CVE-2020-25079).

Together, the pair amounts to a takeover with no credentials. The first bug supplies the password that the second needs. CISA's enrichment rates the password leak as automatable.

D-Link's current [SAP10180](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180) grew to cover more models after Qihoo 360 reported on August 28, 2020 that the flaw reached other cameras. Hotfixes followed through May 2021.

On August 5, 2025, CISA [added both CVEs](https://www.cisa.gov/news-events/alerts/2025/08/05/cisa-adds-three-known-exploited-vulnerabilities-catalog) to the KEV catalog ([CVE-2020-25078](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078), [CVE-2020-25079](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25079)) with an August 26 deadline. The entries say the products may be end-of-life and tell users to stop using them.

## Who is affected

Per SAP10180: DCS-2530L v1.05.05 and older (fixed in v1.07.00 Hotfix through the mydlink app) and DCS-2670L v2.02 and older (fixed in v2.03.00 Hotfix). Six business models in the DCS-46xx, 47xx and 48xx series also received hotfixes. The non-US DCS-P703 is end of service life and will not be fixed. D-Link's [DCS-2530L support page](https://support.dlink.com/productinfo.aspx?m=DCS-2530L) says technical support ended on September 17, 2021. D-Link has not published an end-of-support date for the non-US DCS-2670L as of Oct 23, 2026.

## Do you really need to act?

If you own these cameras, yes. CISA has not said what evidence led to the 2025 listing. The clearest public signal is older. An [FBI notice from December 16, 2024](https://www.ic3.gov/CSA/2024/241216.pdf) says HiatusRAT actors scanned web cameras and DVRs in the US, Australia, Canada, New Zealand and the UK in March 2024. They looked for CVE-2020-25078 among other bugs and used [Ingram](https://github.com/jorhelp/Ingram), an open-source webcam scanner whose project lists this CVE. The FBI describes scanning and "interest," not confirmed D-Link compromises. [The Hacker News](https://thehackernews.com/2025/08/cisa-adds-3-d-link-router-flaws-to-kev.html) noted that no exploitation details were public when CISA acted.

Real exposure is cameras whose web interface is reachable from the internet. That includes small offices and remote workers' homes. A camera on an isolated VLAN with patched firmware is low risk. An unpatched camera with a port forward should be treated as compromised.

## What to do now

1. List every DCS camera with its hardware revision and firmware version, from the device web page or the mydlink app.
2. Remove port forwards and UPnP mappings to cameras. Check with `nmap -Pn -p 80,443,8080 <public-range>`.
3. Install the SAP10180 hotfix where one exists, then set a new admin password.
4. Retire the DCS-P703, and schedule replacement of the unsupported DCS-2530L.
5. Follow the FBI's advice to isolate cameras from the rest of the network.

## How to tell if you were hit

Search web, proxy and IDS logs for requests to `/config/getuser` and `/cgi-bin/ddns_enc.cgi`. On each camera, look for admin changes and DDNS settings you did not make. Watch for unexpected outbound traffic from camera addresses. If an old camera was exposed, reset it to factory defaults before patching or replacing it.

## Timeline

- Jun 11, 2020 — Zero-days in the DCS-2530L are disclosed publicly, per D-Link.
- Jul 26, 2020 — Last update to the DCS-2670L hotfix entry.
- Sep 2, 2020 — CVE-2020-25078 and CVE-2020-25079 are published.
- May 7, 2021 — D-Link lists v1.07.00 Hotfix for the DCS-2530L and hotfixes for the DCS-4xxx models.
- Sep 17, 2021 — DCS-2530L support ends.
- Dec 16, 2024 — FBI reports HiatusRAT scanning for CVE-2020-25078.
- Aug 5, 2025 — CISA adds both CVEs to KEV.

## Sources

1. [D-Link — SAP10180: DCS-2530L, DCS-2670L, DCS-P703 and DCS-46xx/47xx/48xx authenticated command injection and unauthenticated credential disclosure](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180)
2. [D-Link — SAP10180 as first published (archived Aug 5, 2020)](https://web.archive.org/web/20200805160139/https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180)
3. [D-Link — DCS-2530L support page](https://support.dlink.com/productinfo.aspx?m=DCS-2530L)
4. [CVE record — CVE-2020-25078](https://www.cve.org/CVERecord?id=CVE-2020-25078)
5. [CVE record — CVE-2020-25079](https://www.cve.org/CVERecord?id=CVE-2020-25079)
6. [NVD — CVE-2020-25078](https://nvd.nist.gov/vuln/detail/CVE-2020-25078)
7. [NVD — CVE-2020-25079](https://nvd.nist.gov/vuln/detail/CVE-2020-25079)
8. [CISA — Known Exploited Vulnerabilities: CVE-2020-25078](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25078)
9. [CISA — Known Exploited Vulnerabilities: CVE-2020-25079](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25079)
10. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Aug 5, 2025)](https://www.cisa.gov/news-events/alerts/2025/08/05/cisa-adds-three-known-exploited-vulnerabilities-catalog)
11. [FBI — PIN 20241216-001: HiatusRAT Actors Targeting Web Cameras and DVRs](https://www.ic3.gov/CSA/2024/241216.pdf)
12. [GitHub — Ingram webcam scanning tool](https://github.com/jorhelp/Ingram)
13. [The Hacker News — CISA Adds 3 D-Link Flaws to KEV](https://thehackernews.com/2025/08/cisa-adds-3-d-link-router-flaws-to-kev.html)

---
Source page: https://erroneo.us/security/briefs/d-link-dcs-2530l-2670l-cve-2020-25078-25079-camera-flaws/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt