Attacker Value
Low
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2020-25078

Disclosure Date: September 02, 2020
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Validated
Validated

Description

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

Add Assessment

3
Ratings
Technical Analysis

Vulnerability

The D-LInk DCS-2530L is an IP Camera. This means it is more likely to be a target for botnets / IoT auto exploitation rather than anything else.

Triggering the exploit is very simple its just a GET request to the /config/getuser?index=0" endpoint and it returns the user|password combinations in clear text.

This can be paired with a second vulnerability reported at the same time, an authenticated command injection vuln, to gain access. See the exploited section below for more details.

resources

The original tweets have been deleted but archive.org has them

https://web.archive.org/web/20200617135938/https://twitter.com/Dogonsecurity/status/1273251236167516161

In the wild.

My honeypots picked up a couple of pings on this, I am assuming automated scanning by some botnets.

{
    "http_headers": {
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "en-GB,en;q=0.5",
        "Connection": "close",
        "Host": "REDACTED:8080",
        "Upgrade-Insecure-Requests": "1",
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"
    },
    "http_host": "REDACTED:8080",
    "http_method": "GET",
    "http_path": "/config/getuser",
    "http_post": {},
    "http_query": "/config/getuser?index=0",
    "http_remote": "205.185.122.102",
    "http_scheme": "http",
    "http_version": "HTTP/1.1",
    "src_ip": "205.185.122.102"
}
CVSS V3 Severity and Metrics
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None

General Information

Vendors

  • dlink

Products

  • dcs-2530l firmware,
  • dcs-2670l firmware

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis