ZeroDay Findings
Sign inSign up

Findings

CVE-2020-25079

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

Published Sep 2, 2020 · updated Jun 16, 2026 · dlink dcs-4703e firmware

D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 2, 2020 · Catalog

    Detected

    D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  2. Aug 5, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Aug 26, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Aug 26, 2025

Affected

  • cpe dlink/dcs-2530l firmwareversion unspecified
  • cpe dlink/dcs-2670l firmwareversion unspecified
  • cpe dlink/dcs-4603 firmwareversion unspecified
  • cpe dlink/dcs-4622 firmwareversion unspecified
  • cpe dlink/dcs-4701e firmwareversion unspecified
  • cpe dlink/dcs-4703e firmwareversion unspecified
  • cpe dlink/dcs-4705e firmwareversion unspecified
  • cpe dlink/dcs-4802e firmwareversion unspecified
  • cpe dlink/dcs-p703 firmwareversion unspecified
  • vendor D-Link DCS-2530L and DCS-2670L Devicesversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2020-25079

    D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2020-25079

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-25079

    30-day exploitation probability 54.0%

    first.org
  • NIST NVDVulnerability recordCVE-2020-25079

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

    nvd.nist.gov

References