CVE-2025-1539 is a high severity stack based buffer overflow in the D-Link DAP-1320 range extender, firmware 1.00. NVD scores it 8.8. D-Link no longer supports the product, so no fix should be expected. Retire the unit, or isolate it from user networks until you can replace it with a supported model.
What's affected
The record lists the D-Link DAP-1320 and its firmware at version 1.00. The weak function is replace_special_char, in the handler for a file path beginning /storagein.pd. The record states the flaw only affects products that are no longer supported by the maintainer. D-Link's legacy products page, which we fetched, lists the DAP-1320 with a last day of support of 28 February 2018 and recommends retiring such products and replacing them with ones that receive firmware updates.
How to check if you're exposed
Check whether you own one. The model number is printed on the device label, and the admin page shows the firmware version. Network discovery lists can also help.
nmap -sn 192.168.0.0/24 | grep -i -B2 "d-link"
Adjust the range to your own network. For each hit, confirm the model. A DAP-1320 on version 1.00 is in scope. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows the attack is network based and needs a low privilege account, so look at who can log in to the extender's admin page.
What to do now
- Locate every DAP-1320 on your networks, including home offices and remote sites.
- Replace the extender with a supported product. D-Link's own legacy page recommends retirement for unsupported units.
- Until it is replaced, place it on an isolated segment and block access to its admin interface from user networks.
- Change the admin password and remove default credentials.
- Record the retirement in your asset inventory so the model does not return through a spares cupboard.
Why it matters
The weakness is a stack based overflow, tracked as CWE-121 and grouped under CWE-787, out of bounds write, and CWE-119, improper restriction of operations within the bounds of a memory buffer. A function that copies or rewrites text into a fixed size stack buffer without checking length can overwrite nearby data, including values the program uses to decide where to run next.
The practical lesson is lifecycle, not patching. A device past its last day of support will collect public flaws and never receive fixes. The record says an exploit has been disclosed. It is not on the CISA KEV list, so the record gives no sign of known use against real systems.
Going further
Range extenders are easy to forget. They sit in a corner, work quietly and are rarely in an asset list. That is exactly why unsupported ones survive for years. A yearly sweep of wireless infrastructure against a list of supported models is a cheap habit.
When you choose a replacement, check the vendor's published support period and security contact before buying. Ask how long firmware updates will be provided, and write the answer down.
Quick check
Will D-Link release a patch?
The record says the product is no longer supported, and D-Link's legacy page lists support as ended in February 2018. Plan on replacement, not a fix.
Can I keep it if it is isolated?
Isolation reduces risk but does not remove it. A supported replacement is the clean answer, and a short extension for an isolated unit should have an end date.
Sources
- Safeguard Gold record for CVE-2025-1539
- NVD entry for CVE-2025-1539
- Fetched reference on legacy.us.dlink.com
Last reviewed: 19 October 2026.
