ID
VAR-202505-0091
CVE
CVE-2025-4355
TITLE
D-Link Systems, Inc. of D-Link DAP-1520 Buffer error vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been classified as critical. This affects the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. D-Link Systems, Inc. of D-Link DAP-1520 The firmware contains a buffer error vulnerability, a heap-based buffer overflow vulnerability, and an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Tenda DAP-1520 is a dual-band wireless access point from China's Tenda company. The vulnerability is caused by the function set_ws_action in the file /dws/api failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | dlink | model: | dap-1520 | scope: | eq | version: | 1.10b04 | Trust: 1.0 |
| vendor: | d link | model: | d-link dap-1520 | scope: | eq | version: | d-link dap-1520 firmware 1.10b04 | Trust: 0.8 |
| vendor: | d link | model: | d-link dap-1520 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | d link | model: | d-link dap-1520 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | dap-1520 1.10b04 beta02 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | CWE-122 | Trust: 1.0 |
| problemtype: | CWE-119 | Trust: 1.0 |
| problemtype: | Buffer error (CWE-119) [ others ] | Trust: 0.8 |
| problemtype: | Heap-based buffer overflow (CWE-122) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-4355 | Trust: 3.2 |
| db: | VULDB | id: | 307473 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2025-004928 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-09926 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/ghostsuzhijian/iot-/blob/main/dap-1520_set_ws_action/dap-1520_set_ws_action.md | Trust: 1.8 |
| url: | https://vuldb.com/?id.307473 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.564720 | Trust: 1.8 |
| url: | https://www.tenda.com.cn/ | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-4355 | Trust: 1.4 |
| url: | https://vuldb.com/?ctiid.307473 | Trust: 1.0 |
SOURCES
| db: | CNVD | id: | CNVD-2025-09926 |
| db: | JVNDB | id: | JVNDB-2025-004928 |
| db: | NVD | id: | CVE-2025-4355 |
LAST UPDATE DATE
2025-05-17T23:05:13.820000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-09926 | date: | 2025-05-16T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-004928 | date: | 2025-05-14T06:41:00 |
| db: | NVD | id: | CVE-2025-4355 | date: | 2025-05-13T20:24:22.710 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-09926 | date: | 2025-05-15T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-004928 | date: | 2025-05-14T00:00:00 |
| db: | NVD | id: | CVE-2025-4355 | date: | 2025-05-06T13:15:52.310 |