EUVD-2026-21309
GHSA-3mmw-7c3p-rqxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link DIR-513 web interface
-
DeliverySend POST request to /goform/formSetRoute
-
ExploitInject oversized curTime parameter
-
ExecutionTrigger buffer overflow
-
ImpactExecute arbitrary code on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | D-Link DIR-513 firmware version 1.10 (end-of-life product). Requires authenticated access to POST /goform/formSetRoute endpoint. Attacker must be logged-in user. Exploits buffer overflow in curTime parameter. Public exploit available. |
| Impact | CVSS 8.8 reflects high severity with network-accessible unauthenticated buffer overflow in legacy D-Link routers. Publicly available exploit code and moderate observed exploitation activity elevate priority. However, end-of-life product status limits blast radius to organizations still operating unsupported DIR-513 devices, likely smaller networks or legacy deployments. |
| Exploit ScenarioDerived | Attacker sends unauthenticated POST request to /goform/formSetRoute with oversized curTime parameter, triggering buffer overflow. Exploit code exists publicly; successful exploitation grants remote code execution with full device compromise on vulnerable firmware version 1.10. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. The formSetRoute function improperly validates the curTime parameter, enabling memory corruption attacks. Publicly available exploit code exists. This vulnerability affects end-of-life hardware no longer supported by D-Link, leaving no vendor remediation pathway.
RemediationAI
No vendor-released patch identified at time of analysis; D-Link has discontinued support for DIR-513 hardware. Immediate device replacement recommended with current-generation router from active product line. Interim risk reduction: disable remote administration interfaces, restrict administrative access to trusted IP ranges via firewall rules, implement network segmentation to isolate device from critical assets. Do NOT expose management interface to internet. Monitor VulDB advisory at https://vuldb.com/vuln/356569 and vendor notifications at https://www.dlink.com/ for potential community firmware alternatives, though no official remediation exists for end-of-life products.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-120 classic buffer overflow in formSetRoute function at /goform/formSetRoute endpoint. Insufficient bounds checking on curTime POST parameter enables stack/heap corruption. CVSS vector PR:L indicates authenticated access required. Affects discontinued D-Link DIR-513 firmware 1.10 with no active maintenance.
Know when Dir 513 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
CVE-2026-6013 is a buffer overflow in D-Link DIR-513 routers (firmware 1.10) that allows authenticated attackers to execute arbitrary code and fully compromise affected devices. Organizations using this end-of-life hardware face complete loss of network perimeter control with no vendor patch available, requiring immediate hardware replacement or network isolation to prevent lateral movement.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to DIR-513 devices via firewall rules (block non-essential inbound traffic), disable remote management features, enforce strong authentication for any local administrative access, and monitor for suspicious POST requests targeting formSetRoute. Consider hardware replacement as primary remediation given end-of-life status.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in D-Link DIR-513 Buffer Overflow Flaws
View all 3Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote at
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endp
Exploit-DB