CVE-2025-4355: High Heap-based Overflow in DAP-1520

CVE-2025-4355 is a high severity (CVSS 8.8) heap-based buffer overflow in the DAP-1520 access point, firmware 1.10B04_BETA02, in the function set_ws_action. The record says the exploit is public. It names no fixed firmware, so check the vendor, restrict access to the admin interface and plan a replacement.

What's affected

The record lists DAP-1520 firmware 1.10B04_BETA02. The affected code is the function set_ws_action in the file /dws/api/. The description says the attack may be launched remotely, and that the exploit has been disclosed to the public and may be used.

There is a naming wrinkle. The description and the vendor link in the record say Tenda DAP-1520, while the product data lists D-Link dap-1520. Confirm the vendor and exact model printed on the label of your device, then check that vendor's support site for a firmware newer than 1.10B04_BETA02.

The record names no fixed version, and I could not confirm one from a vendor advisory. The version string includes BETA, so check whether your unit runs a beta image, and whether a release build exists for your hardware.

How to check if you're exposed

Open the device's management page and read the firmware version on the status or system screen. A value of 1.10B04_BETA02 matches the record.

Then work out who can reach the management interface. Check whether it answers on the wired and wireless networks, from guest segments, and from the internet through any port mapping on an upstream router.

For many devices, use your network inventory to list every DAP-1520 by model label or MAC vendor prefix. Access points and range extenders are often installed in ceilings and cupboards and forgotten.

What to do now

1. Find all DAP-1520 units and note the firmware.
2. Check the vendor support page for a release build newer than 1.10B04_BETA02 and apply it if one exists.
3. If no fix exists, replace the device with a supported access point.
4. Restrict the management interface to a single trusted wired host and make sure it cannot be reached from guest or internet side networks.
5. Change default administrator credentials and disable any management service you do not use.
6. Segment the access point from servers, and log its reboots and configuration changes.

Why it matters

The record classes the issue as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). In a heap-based overflow, the program copies data into a fixed region of memory without checking the size, so the extra data spills over. Here the vulnerable function is set_ws_action. The advisory style write up linked from the record is the place for detail, and this post leaves it there on purpose.

Embedded devices rarely have the memory protections that desktop operating systems add, so a memory error is more likely to give control of the device than a plain crash. The vector says network attack, low complexity and low privileges, which is why it scores 8.8. A login is part of the scoring, so strong credentials help but should not be the only guard.

The record says a public exploit exists, but it does not say that the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. A public exploit and a beta firmware version with no stated fix is a good reason to treat the device as untrusted until proven otherwise.

Quick check

Sources

• Gold entry for CVE-2025-4355
• Public write-up referenced by the NVD record
• VulDB entry 307473 referenced by the NVD record
• Tenda site referenced by the NVD record

Last reviewed: 18 October 2026.