EUVD-2026-13702Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /goform/formEasySetPassword
-
ExploitInject oversized curTime parameter
-
ExecutionTrigger stack buffer overflow
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to D-Link DIR-513 firmware version 1.10 Web Service. Attacker must be an authenticated user to send malicious POST request to /goform/formEasySetPassword with oversized curTime parameter causing stack buffer overflow. Product is end-of-life and unsupported. |
| Impact | This vulnerability presents a significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS score of 8.8 reflects high impact across all CIA triad components with network-based attack vector (AV:N) and low attack complexity (AC:L). The availability of a public proof-of-concept exploit (https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/poc.py) substantially lowers the barrier to exploitation, moving from theoretical to practical threat. The CVSS temporal metrics show Exploit Maturity as Proof-of-Concept (E:P) with Report Confidence Reasonable (RC:R), while Remediation Level is marked as Unavailable (RL:X) because D-Link no longer supports this end-of-life product. The combination of public exploit code, network accessibility, and no available patch makes this a priority for organizations still running these devices. However, the requirement for authentication provides some mitigation, and the limited install base of this specific legacy model may reduce overall exposure compared to more widely deployed products. |
| Exploit ScenarioDerived | An attacker who has obtained valid credentials to the router's web interface (through credential stuffing, default passwords, or prior compromise) connects to the device over the network and accesses the /goform/formEasySetPassword endpoint. The attacker crafts a malicious HTTP request with an oversized curTime parameter designed to overflow the stack buffer, overwriting the return address with a pointer to shellcode embedded in the payload. Upon function return, execution is redirected to the attacker's code, granting them full control over the router to intercept traffic, modify DNS settings, or pivot to other network devices. The public proof-of-concept code on GitHub provides a ready-made exploit that can be easily adapted for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint allows unauthenticated attackers to achieve full system compromise through a malicious curTime parameter. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with network access can execute arbitrary code with high privileges without user interaction.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the D-Link DIR-513 router version 1.10, specifically in the formEasySetPassword function accessible via the /goform/formEasySetPassword endpoint. An authenticated attacker can exploit this vulnerability remotely by manipulating the curTime parameter to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub, and this product is end-of-life with no vendor support available.
RemediationAI
Since the D-Link DIR-513 is end-of-life and no security patches will be released (Remediation Level: Unavailable), the primary remediation is to immediately replace the affected device with a currently supported router model from D-Link or another vendor. Organizations that cannot immediately replace the device should implement compensating controls including disabling remote management access to the web interface, restricting administrative access to trusted IP addresses only through firewall rules, using strong unique passwords for administrative accounts, and isolating the device on a separate network segment. Monitor the device logs for suspicious authentication attempts or unexpected configuration changes. Given the public availability of exploit code at https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/formEasySetPassword.md, these mitigations should be considered temporary measures only until device replacement is completed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects D-Link DIR-513 wireless router firmware version 1.10 (CPE: cpe:2.3:a:d-link:dir-513:*:*:*:*:*:*:*:*), specifically within the web service component that handles administrative functions. The root cause is a CWE-121 stack-based buffer overflow, which occurs when the formEasySetPassword function fails to properly validate the length of user-supplied input in the curTime argument before copying it to a fixed-size buffer on the stack. This classic memory corruption vulnerability allows adjacent memory to be overwritten with attacker-controlled data, potentially including return addresses and function pointers that can redirect program execution. The vulnerability resides in the router's embedded web server that processes configuration changes, making it accessible through the device's administrative interface.
Know when Dir 513 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/formEasySetPassword of the component Web Service. The manipulation of the argument curTime results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
A critical remote code execution vulnerability affects D-Link DIR-513 routers (version 1.10) that allows authenticated attackers to gain complete control of affected devices. Organizations using these end-of-life routers face immediate risk of network compromise, data exfiltration, and business disruption, particularly if these devices control network access or manage sensitive traffic.
Implement network segmentation to restrict management access to affected routers (limit /goform/formEasySetPassword endpoint access via firewall rules). Disable remote management capabilities and restrict administrative access to trusted internal IP ranges only. Deploy Web Application Firewall (WAF) rules to block POST requests to /goform/formEasySetPassword with suspicious curTime parameters. Monitor for unauthorized access attempts and implement intrusion detection signatures for known exploit patterns. Establish 24/7 network monitoring of affected devices for anomalous outbound traffic. Execute firmware downgrade review if earlier versions lack this vulnerability. Plan immediate replacement as end-of-life status means no security updates are forthcoming.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in D-Link DIR-513 Command Injection and Buffer Overflow
View all 2Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achi
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary c
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitra
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote at
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endp
Exploit-DB