U.S. CISA adds D-Link cameras and Network Video Recorder flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds D-Link cameras and Network Video Recorder flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the descriptions for these flaws:

• CVE-2020-25078 D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability. A vulnerability in D-Link DCS-2530L (pre-1.06.01 Hotfix) and DCS-2670L (up to 2.02) allows remote attackers to access the admin password via an unauthenticated endpoint.
• CVE-2020-25079 D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability. D-Link DCS-2530L (pre-1.06.01 Hotfix) and DCS-2670L (up to 2.02) devices have a flaw in cgi-bin/ddns_enc.cgi that allows authenticated command injection.
• CVE-2022-40799 D-Link DNR-322L Download of Code Without Integrity Check Vulnerability. A data integrity flaw in the “Backup Config” feature of D-Link DNR-322L (≤ 2.60B15) lets authenticated attackers run OS-level commands on the device.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by August 26, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cisa)