CVE-2020-25079

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180Patch, Vendor Advisory
https://twitter.com/Dogonsecurity/status/1271265152118259712Broken Link, Exploit, Third Party Advisory
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180Patch, Vendor Advisory
https://twitter.com/Dogonsecurity/status/1271265152118259712Broken Link, Exploit, Third Party Advisory
https://support.dlink.com/productinfo.aspx?m=DCS-2530LProduct
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25079US Government Resource

Timeline

Published: Sep 2, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 5, 2025
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-25087.2A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execut CVE-2020-250823.8An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptogra CVE-2020-250843.2QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.CVE-2020-250855.0QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SD CVE-2020-250866.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.CVE-2020-250876.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.CVE-2020-250886.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.CVE-2020-250896.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.CVE-2020-25099.8A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execut CVE-2020-250906.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.CVE-2020-250916.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.CVE-2020-250926.1Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, applicati