CVE-2025-8169 is a high (CVSS 8.8) buffer overflow in D-Link DIR-513 (DIR-513 version 1.10 (the write-up says firmware A1FW110 and A2FW110)). The record names no fixed version, so plan on isolating or replacing it. The record says the product is no longer supported by the maintainer.
What's affected
The record lists DIR-513 version 1.10 (the write-up says firmware A1FW110 and A2FW110) as affected. The vulnerable code is in /goform/formSetWanPPTPpath, through the curTime argument.
No fixed firmware is named. The record says the product is no longer supported by the maintainer.
The write-up says the formSetWanPPTP handler in the boa web server joins curTime into a stack buffer with sprintf without a length check, with the same crash and possible shell access outcome as its sibling reports. Its file names and headings do not line up neatly across the four DIR-513 write-ups, so match each CVE by the function named in the record.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, a score of 8.8. The write-up shows no vendor response.
The record also says the exploit has been disclosed to the public and may be used. That is not the same as confirmed attacks: this CVE is not in CISA's Known Exploited Vulnerabilities catalog (the record's kev flag is false).
How to check if you're exposed
Find the model and firmware version on the device's status page or, if you manage many devices, in your asset inventory. Then confirm whether the management interface is reachable from outside your network. From a machine outside your perimeter:
nmap -Pn -p 23,80,443,8080 YOUR_PUBLIC_ADDRESS
If the web management port answers from the internet, treat the device as exposed whatever its firmware says.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you operate this device and which firmware it runs.
- Take the web management interface off the internet and limit it to a trusted internal address.
- Check D-Link's support pages for a firmware update for your hardware revision. The record says the product is no longer supported, so a fix may never ship.
- If the device is end of life, replace it with a supported one.
- Log in to the router's status page after any change and confirm the settings are what you expect.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-119 (improper restriction of operations within a memory buffer), CWE-120 (classic buffer overflow), CWE-787 (out-of-bounds write). A buffer overflow happens when code copies input into a fixed size memory area without checking its length. On a router the web server often runs with high privilege, so memory corruption in a request handler can mean a crash or worse. Embedded devices rarely get fast patches, so reducing exposure is the main control.
The record says this DIR-513 flaw only affects a product that is no longer supported by the maintainer. That means a fix may never come, and replacement is the real remedy.
Quick check
Is there a patch for CVE-2025-8169?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-8169 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. The record does say the exploit has been disclosed to the public, so assume attackers can find it.
Sources
- Safeguard Gold entry for CVE-2025-8169
- Public write-up on GitHub
- NVD record data for CVE-2025-8169, published 2025-07-25, source cna@vuldb.com
Last reviewed: 18 October 2026.
