CVE-2025-8169
published 2025-07-25CVE-2025-8169: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.51%
71.6th percentile
A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d-link | dir-513 | — | — |
| dlink | dir-513_firmware | — | — |
| msrc | cm1_curl_7.76.0-5_on_cbl_mariner_1.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/goform/formSetWan
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/formSetWan"; fast_pattern; startswith; pcre:"/^(?:L2TP|PPTP|PPPoE)$/R"; http.request_body; content:"curTime|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-8168; reference:cve,2025-8184; reference:cve,2025-8169; reference:url,github.com/InfiniteLin/Lin-s-CVEdb; classtype:web-application-attack; sid:2063869; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_01, cve CVE_2025_8184_CVE_2025_8169, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)bytes
curTime|3d|
- →Attack is delivered via HTTP POST to /goform/formSetWanPPTPpath; the vulnerable parameter is `curTime` in the POST body. A buffer overflow is triggered when curTime value exceeds ~100 characters. ↗
- →The Snort/ET rule (sid:2063869) fires on POST requests whose URI starts with /goform/formSetWan followed by L2TP, PPTP, or PPPoE suffix, and whose body contains `curTime=` with a value of 100+ characters — use this length threshold as a detection heuristic.
- →Attack is plaintext (no TLS); deploy detection at the network perimeter and internally on segments hosting D-Link DIR-513 devices.
- →Public exploit PoC is available at github.com/InfiniteLin/Lin-s-CVEdb; monitor for scanning/exploitation attempts originating from or referencing this repository.
- →MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — prioritise perimeter-facing D-Link DIR-513 devices running firmware 1.10.
- ·The affected product (D-Link DIR-513 1.10) is end-of-life and will receive no vendor patch; the only remediation is device replacement or network-level blocking. ↗
- ·The ET rule (sid:2063869) covers three related CVEs (CVE-2025-8168, CVE-2025-8169, CVE-2025-8184) across multiple /goform/formSetWan* endpoints; tune or split the rule if per-CVE fidelity is required.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g6xf-cqq5-rjpx: A vulnerability classified as critical has been found in D-Link DIR-513 1
ghsa_unreviewed·2025-07-25
CVE-2025-8169 [HIGH] CWE-119 GHSA-g6xf-cqq5-rjpx: A vulnerability classified as critical has been found in D-Link DIR-513 1
A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Microsoft
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
vendor_msrc·2020-12-08·CVSS 7.5
CVE-2020-8169 [HIGH] CWE-200 curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Ma
Suricata
ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)
suricata·2025-08-01·CVSS 7.4
CVE-2025-8168 [HIGH] ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)
ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link formSetWAN Multiple Endpoints curTime Parameter Buffer Overflow Attempt (CVE-2025-8184, CVE-2025-8169, CVE,2025-8168)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/goform/formSetWan"; fast_pattern; startswith; pcre:"/^(?:L2TP|PPTP|PPPoE)$/R"; http.request_body; content:"curTime|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-8168; reference:cve,2025-8184; reference:cve,2025-8169; reference:url,github.com/InfiniteLin/Lin-s-CVEdb; classtype:web-application-attack; sid:2063869; rev:1; metadata:affected_product D_Link, attack_target Ne
No public exploits indexed.
No writeups or analysis indexed.
2025-07-25
Published