D-Link Cameras CVE-2025-13607

Exploitation requires network reachability to the affected D-Link camera's web service and a request to a specific URL that returns configuration data without any authentication (CWE-306); no credentials, user interaction, or special client state is needed. The practical limiting factor is network exposure: cameras on isolated/segmented LANs behind NAT are only reachable by local or pivoting attackers, whereas devices with the web interface exposed to the internet or a flat network are directly exploitable by remote unauthenticated attackers. The exact affected model(s) and firmware are not stated in the input and should be confirmed against D-Link advisory SAP10462 to determine which deployments are in scope.

Multiple signals point in the same direction for severity but diverge on urgency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw - CWE-306 (Missing Authentication for a Critical Function) - that leaks camera configuration including account credentials, which is why the base score is 9.3 (Critical). However, the EPSS score is only 0.78% (55th percentile), indicating low modeled probability of exploitation in the next 30 days, and there is NO CISA KEV listing and no public exploit identified in the provided data. This is the classic 'high-CVSS, not-yet-widely-exploited' profile: the technical barrier to exploitation is trivial (hit a URL, no auth), so it SHOULD be treated as a near-term priority for anyone running the affected D-Link cameras, but there is currently no evidence of active, widespread exploitation. One caveat on the input itself: the vendor-supplied 4.0 vector sets VI:H and VA:L, yet the description only describes unauthenticated READ access to configuration/credentials (a confidentiality event). The direct integrity/availability impact appears overstated unless credential disclosure is being scored as enabling downstream device takeover - verify with the D-Link advisory (SAP10462). No SSVC decision data was provided in the input.

An attacker on the network path to the camera (or the internet, if the device's web interface is exposed) requests a specific unauthenticated URL on the camera and receives its configuration data, including stored account credentials. Those credentials can then be reused to log in to the camera's admin interface - or replayed against other services if the account is shared - giving full control of the device. No public exploit was identified in the provided data, but the attack requires nothing more than an HTTP request.