SecOps SignalSecurity Intelligence Workspace
Loading collection status
Vulnerabilities/CVE-2020-25079Public Intelligence Dossier
Source: dlink · Limited verification•Last verified: •Collection Healthy
CVE-2020-25079ListedHIGH (raw)CVSS 9.0CWE-77

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices

Published: 02 Sept 2020•Last updated: 17 Jun 2026, 08:36 AM IST•Source identifier: cve@mitre.org
Dossier completeness: source-provided sections 3 / 3 · rule guidance available. Missing source facts count as incomplete.
Official source
CISA KEV catalog
Listed
Added05 Aug 2025
Due26 Aug 2025
RansomwareUnknown
CVSS score
9.0HIGH (raw)
AV:N/AC:L/Au:S/C:C/I:C/A:C
Metric sourcenvd@nist.gov
EPSS probability
54%0.540
Percentile99th
Weakness type
CWE-77
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded

Why It Matters

Analysis dossier

Why It Matters

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.

SOC priority

Immediate Attention

Actively exploited

Yes

Publicly disclosed

Unknown

Risk basis: CISA KEV exploitation signal; HIGH severity; Known exploitation signal from CISA KEV or ransomware metadata

Affected Products & Remediation

9 source-backed products
Affected products and versions (source)
  • dlink dcs-4703e firmware · < 1.03.04 · NVD CPE · Source
  • dlink dcs-4705e firmware · < 1.03.02 · NVD CPE · Source
  • dlink dcs-4802e firmware · < 2.01.01 · NVD CPE · Source
  • dlink dcs-p703 firmware · version range not provided by source · NVD CPE · Source
  • dlink dcs-4603 firmware · < 1.04.02 · NVD CPE · Source
  • dlink dcs-4622 firmware · < 2.01.10 · NVD CPE · Source
  • dlink dcs-4701e firmware · < 2.03.01 · NVD CPE · Source
  • dlink dcs-2530l firmware · <= 1.05.05 · NVD CPE · Source
  • dlink dcs-2670l firmware · < 2.03.00 · NVD CPE · Source
NVD applicability prerequisites: cpe:2.3:h:dlink:dcs-4703e:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4705e:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4802e:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-p703:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4603:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4622:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4701e:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-2530l:-:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-2670l:-:*:*:*:*:*:*:*. These are conditions, not proof that an environment is exposed or unaffected.
Recorded patch / KBNot provided by source

Vendor or catalog guidance (source)

  • CISA KEV: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known exploitation (source facts)

Only what a source states. Unknown means no source has said either way; it is not "not exploited".

CISA KEV
Listed
Exploited (source statement)
Yes
Publicly disclosed (source)
Unknown

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Suggested hunting (rule-based inference)

SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.

Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed)

Exposure

  1. Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure

Exploitation evidence

  1. Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure

Response

  1. Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure

CISA KEV Record

Catalog entry
05 Aug 2025
Required action due
26 Aug 2025
Known ransomware use
Unknown

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Change History & Source Data

— No recorded material change

CNA / source
cve@mitre.org
Record status · verification
UPDATED · CISA KEV confirmed
CPE
cpe:2.3:o:dlink:dcs-4703e_firmware:*:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4703e:-:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dcs-4705e_firmware:*:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4705e:-:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dcs-4802e_firmware:*:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4802e:-:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dcs-p703_firmware:*:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-p703:-:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dcs-4603_firmware:*:*:*:*:*:*:*:*, cpe:2.3:h:dlink:dcs-4603:-:*:*:*:*:*:*:*

Evidence & Provenance

4 public sources
CISA KEV CatalogAdded 2025-08-05supportannouncement.us.dlink.comSource recordnvd.nist.govSource recordtwitter.comSource record

Linked by the query's stored exact CVE association. Review required tables and validation status before use.

Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2020-25079
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2020-25079
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2020-25079"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc
Schema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Open KQL Library
Loading related intelligence

Correlated briefings

SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.