CVE-2025-8159 is a high (CVSS 8.8) stack-based buffer overflow in D-Link DIR-513 (DIR-513 version 1.0). The record names no fixed version, so plan on isolating or replacing it. The record says the product is no longer supported by the maintainer.
What's affected
The record lists DIR-513 version 1.0 as affected. The vulnerable code is in /goform/formLanguageChange, through the curTime argument.
No fixed firmware is named. The record says the product is no longer supported by the maintainer.
The record places the flaw in the formLanguageChange function of the HTTP POST request handler. Three other DIR-513 flaws with the same curTime pattern were published in the same days: CVE-2025-8168, CVE-2025-8169 and CVE-2025-8184 are covered in sibling posts.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, a score of 8.8. I could not retrieve the write-up the record links, so this post relies on the NVD record.
The record also says the exploit has been disclosed to the public and may be used. That is not the same as confirmed attacks: this CVE is not in CISA's Known Exploited Vulnerabilities catalog (the record's kev flag is false).
How to check if you're exposed
Find the model and firmware version on the device's status page or, if you manage many devices, in your asset inventory. Then confirm whether the management interface is reachable from outside your network. From a machine outside your perimeter:
nmap -Pn -p 23,80,443,8080 YOUR_PUBLIC_ADDRESS
If the web management port answers from the internet, treat the device as exposed whatever its firmware says.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you operate this device and which firmware it runs.
- Take the web management interface off the internet and limit it to a trusted internal address.
- Check D-Link's support pages for a firmware update for your hardware revision. The record says the product is no longer supported, so a fix may never ship.
- If the device is end of life, replace it with a supported one.
- Log in to the router's status page after any change and confirm the settings are what you expect.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-119 (improper restriction of operations within a memory buffer), CWE-121 (stack-based buffer overflow), CWE-787 (out-of-bounds write). A buffer overflow happens when code copies input into a fixed size memory area without checking its length. On a router the web server often runs with high privilege, so memory corruption in a request handler can mean a crash or worse. Embedded devices rarely get fast patches, so reducing exposure is the main control.
The record says this DIR-513 flaw only affects a product that is no longer supported by the maintainer. That means a fix may never come, and replacement is the real remedy.
Quick check
Is there a patch for CVE-2025-8159?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-8159 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. The record does say the exploit has been disclosed to the public, so assume attackers can find it.
Sources
- Safeguard Gold entry for CVE-2025-8159
- VulDB entry 317573 listed in the record (listed in the record, not retrievable when reviewed)
- NVD record data for CVE-2025-8159, published 2025-07-25, source cna@vuldb.com
Last reviewed: 18 October 2026.
