CVE-2025-1876: High Buffer Overflow in D-Link DAP-1562

CVE-2025-1876 is a high severity (7.3) stack-based buffer overflow in the HTTP header handler of the D-Link DAP-1562 access point, firmware 1.10. The record says the product is no longer supported by its maintainer, so no fix should be expected. Replace the device or take its management interface off every untrusted network.

What's affected

The record lists the D-Link DAP-1562 and its firmware, version 1.10. The flaw is in the function http_request_parse, in the component that handles HTTP headers, and the argument involved is the Authorization header. The weakness is classed under CWE-119, CWE-121 and CWE-787, which together describe memory written outside a buffer, here on the stack.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain words, it is reachable over the network, needs no account and no user action, and the record rates the impact as low across confidentiality, integrity and availability. The description adds that the exploit has been disclosed to the public. The record is not listed in CISA Known Exploited Vulnerabilities, and I found no source stating it is exploited in the wild.

Fixed versions: none. The description states that this vulnerability only affects products that are no longer supported by the maintainer. I could not retrieve a vendor advisory with a patch, so check D-Link's support pages for the model, but plan on replacing the hardware.

How to check if you're exposed

Find out whether you own the device and whether anyone can reach its web interface.

1. Look for DAP-1562 units in your asset list, purchase records and on the device label.
2. Sign in to the admin page and read the firmware version on the status page. Version 1.10 is the one the record names.
3. From a machine on each network segment, check whether the management page answers. On your own network, a port check works.

nmap -p 80,443 192.168.1.0/24

Replace the range with your own. Any access point that answers on those ports from a guest or user segment is reachable by the people the flaw is aimed at. If the device is managed from the internet, treat that as the most urgent finding.

What to do now

1. List every DAP-1562 and any other D-Link device that the vendor has retired.
2. Plan a replacement with a supported access point and put the purchase on a near date, not an open ticket.
3. Until it is replaced, restrict the management interface to one admin workstation or a management VLAN, and block it from guest and user networks.
4. Turn off remote administration from the internet if it is enabled.
5. Keep a note of the device in your risk register as an unsupported asset, with the date you intend to retire it.
6. Watch the vendor's support page for any statement, but do not wait on one.

These steps are general hardening for an unsupported network device. They are not instructions from a vendor advisory, because none was available to me.

Why it matters

A stack overflow happens when a program copies more data into a fixed buffer than it can hold and overwrites the memory next to it. Embedded web servers are written in C, parse headers by hand and run with high privileges, so this class of bug appears often in routers and access points. Here the unchecked data is the Authorization header, which a web server must read before it decides who you are. That is why no account is needed.

Unsupported hardware is the harder half of the problem. A vendor that has retired a product does not publish patches, yet the device keeps sitting on the network and bridging users to internal systems. The only complete fix is to remove it. Inventory is what makes that possible, because you cannot retire a device you do not know you have.

Quick check

Sources

• CVE-2025-1876 on Safeguard Gold
• Public write-up and vendor homepage listed in the CVE record (write-up, D-Link). I could not verify them while writing.

Last reviewed: 19 October 2026.