- Description
- An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 9
- Impact score
- 10
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:C/I:C/A:C
Data from CISA
- Vulnerability name
- D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability
- Exploit added on
- Aug 5, 2025
- Exploit action due
- Aug 26, 2025
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2530l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93C1E07C-D4C7-4CB2-B0F7-01F838A3555B",
"versionEndIncluding": "1.05.05"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2530l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "40A05FF4-4847-41C2-946A-F8043481E11F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:dlink:dcs-2670l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD06916A-B4D7-4E0F-8007-A97BB3B1D44B",
"versionEndIncluding": "2.02"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:dlink:dcs-2670l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F66D7CA9-66E1-4A37-88AA-2E98DC0416C0"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]