cbcvebase.
CVE-2025-8169
published 2025-07-25

CVE-2025-8169: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file…

PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.51%
71.6th percentile
A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

3 ranges
VendorProductVersion rangeFixed in
d-linkdir-513
dlinkdir-513_firmware
msrccm1_curl_7.76.0-5_on_cbl_mariner_1.0

Detection & IOCsextracted from sources · hover to see the quote

url/goform/formSetWanPPTPpath
path/goform/formSetWan
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/formSetWan"; fast_pattern; startswith; pcre:"/^(?:L2TP|PPTP|PPPoE)$/R"; http.request_body; content:"curTime|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-8168; reference:cve,2025-8184; reference:cve,2025-8169; reference:url,github.com/InfiniteLin/Lin-s-CVEdb; classtype:web-application-attack; sid:2063869; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_01, cve CVE_2025_8184_CVE_2025_8169, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
curTime|3d|
  • Attack is delivered via HTTP POST to /goform/formSetWanPPTPpath; the vulnerable parameter is `curTime` in the POST body. A buffer overflow is triggered when curTime value exceeds ~100 characters.
  • The Snort/ET rule (sid:2063869) fires on POST requests whose URI starts with /goform/formSetWan followed by L2TP, PPTP, or PPPoE suffix, and whose body contains `curTime=` with a value of 100+ characters — use this length threshold as a detection heuristic.
  • Attack is plaintext (no TLS); deploy detection at the network perimeter and internally on segments hosting D-Link DIR-513 devices.
  • Public exploit PoC is available at github.com/InfiniteLin/Lin-s-CVEdb; monitor for scanning/exploitation attempts originating from or referencing this repository.
  • MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — prioritise perimeter-facing D-Link DIR-513 devices running firmware 1.10.
  • ·The affected product (D-Link DIR-513 1.10) is end-of-life and will receive no vendor patch; the only remediation is device replacement or network-level blocking.
  • ·The ET rule (sid:2063869) covers three related CVEs (CVE-2025-8168, CVE-2025-8169, CVE-2025-8184) across multiple /goform/formSetWan* endpoints; tune or split the rule if per-CVE fidelity is required.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.