CVE-2025-8169
Published: 25 July 2025
Summary
CVE-2025-8169 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-513. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 20.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
A critical buffer overflow vulnerability, tracked as CVE-2025-8169, affects the D-Link DIR-513 wireless router running firmware version 1.10. The flaw resides in the formSetWanPPTPcallback function within the /goform/formSetWanPPTPpath component of the HTTP POST Request Handler, where improper handling of the curTime argument permits out-of-bounds memory access. The issue is catalogued under CWE-119, CWE-120, and CWE-787 and carries a CVSS 4.0 score of 7.4.
An authenticated remote attacker can supply a crafted HTTP POST request to trigger the overflow, potentially achieving arbitrary code execution or a denial-of-service condition on the device. Public exploit code has already been disclosed, although the vulnerability is restricted to an end-of-life product line that receives no further vendor support.
The referenced advisories and the D-Link site contain no mitigation guidance beyond confirming the device is unsupported; administrators are therefore advised to retire the hardware. The associated EPSS score has remained flat at 0.0118 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22755
Vulnerability details
A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is…
more
possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote buffer overflow in router web interface enables exploitation for privilege escalation to shell access (T1068), initial access via public-facing application (T1190), and denial-of-service via application crash (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow by validating and sanitizing the curTime argument in HTTP POST requests to the vulnerable endpoint.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow vulnerability.
Prohibits the use of unsupported end-of-life devices like the D-Link DIR-513, eliminating exposure to unpatched buffer overflow vulnerabilities.