U.S. CISA adds D-Link cameras and Network Video Recorder flaws to its Known Exploited Vulnerabilities catalog

D-Link DCS-2530L and DCS-2670L IP camera firmware contains an authenticated command injection flaw (CWE-77) in the cgi-bin/ddns_enc.cgi endpoint, which handles dynamic DNS (DDNS) configuration. An attacker with valid credentials for the camera's web interface (default or weak passwords are common on consumer cameras) can submit crafted input through this endpoint to execute arbitrary operating-system commands on the device; the CVSS 3.1 score of 8.8 reflects network reachability, low privilege required, no user interaction, and high confidentiality, integrity, and availability impact. Successful compromise gives the attacker control of the camera, access to its video feed, and a potential foothold for pivoting into the network the camera sits on. The affected population is DCS-2530L units on firmware before 1.06.01 Hotfix and DCS-2670L units on firmware through 2.02, typically deployed in homes and small-business settings. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-05 amid evidence of active exploitation, and EPSS assigns it a 52.7% probability of exploitation within 30 days (99th percentile).

Do: Upgrade DCS-2530L cameras to firmware 1.06.01 Hotfix or later, and DCS-2670L cameras to a post-2.02 firmware/hotfix per D-Link's advisory; since these are older consumer models that may no longer receive updates, replace or retire units that cannot be patched. Because exploitation requires valid credentials, enforce strong non-default passwords, remove internet-facing port forwarding/UPnP exposure of the cameras' web interfaces, and restrict management access to trusted networks; U.S. federal agencies should follow the applicable BOD 22-01 guidance or discontinue use if mitigations are unavailable. Given the KEV listing, check exposed units for signs of compromise such as modified settings or unexpected outbound connections.

CVE-2022-40799 is a download-of-code-without-integrity-check flaw (CWE-494) in the D-Link DNR-322L network video recorder, which accepts and runs downloaded code without verifying it is authentic and unmodified. An attacker who already holds valid credentials on the device can trigger download and execution of unsigned code, gaining the ability to issue operating-system-level commands on the NVR. Successful exploitation yields control of the recorder, its stored camera footage, and a foothold for further attacks on the surveillance network. Only D-Link DNR-322L deployments are affected, and the product is end-of-life/end-of-service, so owners should expect limited or no vendor remediation and are advised to discontinue use. Exploitation is confirmed: CISA added the flaw to the KEV catalog on 2025-08-05, EPSS puts the 30-day exploitation probability at 31.7% (98th percentile), and no public proof-of-concept is known.

Do: Inventory your environment for DNR-322L recorders and, per CISA's required action, apply any mitigations D-Link has published or retire the device, since the product is EoL/EoS and the vendor recommends discontinuing use. If the recorder must stay in service, keep its management interface off the public internet behind a firewall and monitor for signs of command execution; federal agencies must remediate or discontinue use in line with BOD 22-01 deadlines.