CVE-2025-8184
Published: 26 July 2025
Summary
CVE-2025-8184 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-513. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Deeper analysis
A critical vulnerability exists in D-Link DIR-513 firmware up to version 1.10, specifically in the formSetWanL2TPcallback function of the /goform/formSetWanL2TPtriggers file within the HTTP POST Request Handler component. The issue stems from improper handling of input that triggers a stack-based buffer overflow, tracked under CWE-119, CWE-121, and CWE-787, and carries a CVSS 4.0 score of 7.4 reflecting network-accessible attack vectors with low complexity and high impact on confidentiality, integrity, and availability.
An attacker with low privileges can initiate the exploit remotely by sending a crafted HTTP POST request to the affected endpoint. Successful exploitation grants the ability to execute arbitrary code or crash the device, and a working proof-of-concept has already been published.
The affected router model is no longer supported by D-Link, so no official patches or firmware updates are expected. Public references, including disclosure details on Vuldb and a GitHub repository, confirm the issue but provide no mitigation guidance beyond general avoidance of the unsupported product.
EPSS remains flat at a low value of 0.0121 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22789
Vulnerability details
A vulnerability was found in D-Link DIR-513 up to 1.10 and classified as critical. This issue affects the function formSetWanL2TPcallback of the file /goform/formSetWanL2TPtriggers of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack…
more
may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the router's HTTP POST handler (formSetWanL2TPcallback) is directly exploitable over the network by an authenticated user, matching the definition of T1190 Exploit Public-Facing Application and enabling arbitrary code execution on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflows by validating HTTP POST request inputs in the formSetWanL2TPcallback function.
Implements memory protections such as non-executable stacks and guard pages to mitigate exploitation of the stack-based buffer overflow.
Prohibits and requires removal of unsupported end-of-life components like the D-Link DIR-513 with no available patches.