CVE-2025-70245

CRITICAL
2026-03-12 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:57 vuln.today
CVE Published
Mar 12, 2026 - 19:16 nvd
CRITICAL 9.8

Tags

Buffer Overflow D-Link RCE Dir 513 Firmware

Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.

Analysis

D-Link DIR-513 router (v1.10) has a stack buffer overflow in the curTime parameter of formSetWizardSelectMode. This is an end-of-life router with no expected patch, meaning exploitation will remain possible indefinitely.

Technical Context

The formSetWizardSelectMode handler does not bounds-check the curTime parameter before copying it to a stack buffer (CWE-787). A sufficiently long input overwrites the return address, enabling attacker-controlled code execution. As a MIPS-based router, exploitation follows well-known MIPS ROP techniques.

Affected Products

D-Link DIR-513 v1.10 (end-of-life)

Remediation

Replace the D-Link DIR-513 with a currently supported router. If replacement is not immediately possible, disable remote management and restrict LAN access to the admin interface.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +49
POC: 0

Share

CVE-2025-70245 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy