CVE-2025-1539
Published: 21 February 2025
Summary
CVE-2025-1539 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dap-1320 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of all inputs to functions like replace_special_char to prevent stack-based buffer overflows from improper restriction of operations within memory bounds (CWE-119, CWE-121, CWE-787).
Implements memory protections such as stack canaries, ASLR, and non-executable memory stacks to mitigate exploitation of stack-based buffer overflows leading to arbitrary code execution.
Prohibits or mitigates risks from unsupported system components like the end-of-life D-Link DAP-1320 firmware with no available patches, preventing exposure to this unremediable critical vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in network device firmware service enables remote authenticated code execution against public-facing or remote services.
NVD Description
A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the file /storagein.pd-XXXXXX. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The…
more
exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2025-1539 is a critical stack-based buffer overflow vulnerability affecting the replace_special_char function in the /storagein.pd-XXXXXX file of D-Link DAP-1320 firmware version 1.00. Published on 2025-02-21, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs-119, CWE-121, and CWE-787.
The vulnerability enables remote exploitation by an authenticated attacker with low privileges, requiring no user interaction. Successful manipulation can result in high impacts to confidentiality, integrity, and availability, potentially leading to arbitrary code execution via the buffer overflow.
Advisories note that this vulnerability only affects products no longer supported by the maintainer, with no patches available. Relevant details are available in references including the D-Link product page at https://legacy.us.dlink.com/pages/product.aspx?id=4b2bbe2e3f1d440ea65bc56c7e3dcc5c, a technical writeup at https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-replace_special_char-Vulnerability-1960448e6195809c94f9fd2ff1f59bcf?pvs=4, and VulDB entries at https://vuldb.com/?ctiid.296480, https://vuldb.com/?id.296480, and https://vuldb.com/?submit.497496.
The exploit has been publicly disclosed and may be used against vulnerable devices.
Details
- CWE(s)