EUVD-2026-14329
GHSA-fwg7-xgp7-84j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the component boa. This manipulation of the argument curTime causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endpoint allows authenticated attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with valid credentials can exploit this remotely without user interaction to execute arbitrary commands with system privileges.
Technical ContextAI
The vulnerability resides in the boa web server component used by the D-Link DIR-513 router, specifically within the formEasySetTimezone handler located at /goform/formEasySetTimezone. This is a classic stack-based buffer overflow (CWE-121) where insufficient bounds checking on the 'curTime' parameter allows an attacker to write beyond allocated buffer boundaries on the stack. The boa web server is a lightweight embedded HTTP daemon commonly used in IoT and router devices. The affected product is identified by CPE cpe:2.3:a:d-link:dir-513:*:*:*:*:*:*:*:*, indicating all versions of the DIR-513 firmware are potentially vulnerable, with version 1.10 explicitly confirmed.
RemediationAI
Since the D-Link DIR-513 is an end-of-life product with no vendor support or available patches, the primary remediation is immediate device replacement with a currently supported router model from D-Link or another vendor. Organizations and users still operating DIR-513 devices should decommission them as soon as possible. As interim mitigation measures until replacement, restrict administrative access to the web interface by binding management services only to trusted internal networks, implement strong non-default administrative credentials, disable remote management features entirely, and place the device behind a firewall that blocks external access to TCP ports used by the web interface. Network segmentation should isolate affected devices from critical assets. Monitor logs for suspicious authentication attempts or unusual POST requests to /goform/ endpoints.
Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint
Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achi
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary c
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitra
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote at
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today