Null Pointer Dereference Vulnerability in D-Link DAP-1562 Product
CVE-2025-1877

7.1HIGH

Key Information:

Vendor
D-link
Status
Dap-1562
Vendor
CVE Published:
3 March 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A null pointer dereference vulnerability exists in the D-Link DAP-1562 version 1.10, specifically within the pure_auth_check function of the HTTP POST Request Handler. This vulnerability allows attackers to remotely exploit the device by manipulating the argument 'a1', potentially leading to denial of service. It is important to note that this issue primarily affects D-Link products that are no longer supported, making them more susceptible to exploitation. As the exploit has been publicly disclosed, users are urged to consider the associated risks and take preventive measures.

Affected Version(s)

DAP-1562 1.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-1877 - Proof of Concept

References

https://vuldb.com/?id.298191
vdb-entrytechnical-description
https://vuldb.com/?ctiid.298191
signaturepermissions-required
https://vuldb.com/?submit.506526
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.