D-Link - Information Disclosure (CVE-2020-25078)

CVE-2020-25078 is a vulnerability in certain D-Link camera models that exposes the administrator password via an unauthenticated /config/getuser endpoint. This flaw allows remote attackers to obtain sensitive credentials without authentication, potentially leading to full device compromise and unauthorized access to video feeds or device settings.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2020-25078 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2020-25078 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /config/getuser endpoint with the index=0 parameter to retrieve administrator credentials from vulnerable D-Link camera devices.