EUVD-2026-14329
GHSA-fwg7-xgp7-84j9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link DIR-513 web interface
-
ExploitSend crafted request to /goform/formEasySetTimezone
-
ExecutionOverflow curTime parameter in formEasySetTimezone function
-
ImpactOverwrite stack memory and execute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | D-Link DIR-513 firmware version 1.10 (end-of-life product). Requires authenticated access to the web interface. Attacker must send crafted input to the /goform/formEasySetTimezone endpoint with oversized curTime parameter to trigger stack-based buffer overflow in boa component. |
| Impact | This vulnerability presents a critical real-world risk despite requiring low-privilege authentication (PR:L). The CVSS base score of 8.8 reflects network accessibility (AV:N), low attack complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). The existence of a public proof-of-concept exploit (E:P) at https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_24/README.md significantly lowers the barrier for exploitation. The CVSS temporal metrics show no remediation level available (RL:X), which aligns with D-Link's end-of-life status for this product. While authentication is required, many users leave default credentials on legacy devices, making this highly automatable in practice. The combination of public exploit code, remote exploitability, end-of-life status, and stack-based buffer overflow characteristics make this a genuine priority for organizations still running affected devices, despite the authentication requirement slightly reducing immediate mass exploitation risk. |
| Exploit ScenarioDerived | An attacker identifies a D-Link DIR-513 device exposed on the network through port scanning or Shodan searches. After obtaining or guessing low-privilege credentials (potentially using default credentials like admin/admin common on legacy devices), the attacker authenticates to the web interface and sends a specially crafted POST request to /goform/formEasySetTimezone with an oversized 'curTime' parameter containing shellcode. The stack-based buffer overflow triggers, allowing the attacker to hijack execution flow and gain complete control of the router, enabling network traffic interception, credential harvesting, or using the device as a pivot point for further network intrusion. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endpoint allows authenticated attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and affected devices are no longer receiving security updates from the vendor. An attacker with valid credentials can exploit this remotely without user interaction to execute arbitrary commands with system privileges.
Earlier versions of this analysis (1)
A stack-based buffer overflow vulnerability exists in the formEasySetTimezone function of the D-Link DIR-513 router firmware version 1.10. An authenticated attacker can remotely exploit this flaw by manipulating the 'curTime' argument to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub, and this device is no longer supported by D-Link, meaning no official patch will be released.
RemediationAI
Since the D-Link DIR-513 is an end-of-life product with no vendor support or available patches, the primary remediation is immediate device replacement with a currently supported router model from D-Link or another vendor. Organizations and users still operating DIR-513 devices should decommission them as soon as possible. As interim mitigation measures until replacement, restrict administrative access to the web interface by binding management services only to trusted internal networks, implement strong non-default administrative credentials, disable remote management features entirely, and place the device behind a firewall that blocks external access to TCP ports used by the web interface. Network segmentation should isolate affected devices from critical assets. Monitor logs for suspicious authentication attempts or unusual POST requests to /goform/ endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the boa web server component used by the D-Link DIR-513 router, specifically within the formEasySetTimezone handler located at /goform/formEasySetTimezone. This is a classic stack-based buffer overflow (CWE-121) where insufficient bounds checking on the 'curTime' parameter allows an attacker to write beyond allocated buffer boundaries on the stack. The boa web server is a lightweight embedded HTTP daemon commonly used in IoT and router devices. The affected product is identified by CPE cpe:2.3:a:d-link:dir-513:*:*:*:*:*:*:*:*, indicating all versions of the DIR-513 firmware are potentially vulnerable, with version 1.10 explicitly confirmed.
Know when Dir 513 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the component boa. This manipulation of the argument curTime causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
A critical remote code execution vulnerability affecting D-Link DIR-513 routers allows authenticated attackers to gain complete system control. Organizations using this end-of-life device face immediate risk of network compromise, data theft, and operational disruption, with no vendor patch forthcoming.
Network segmentation to limit router access; disable remote management interfaces; restrict administrative access to trusted networks only; implement host-based intrusion detection; consider WAF/IPS signatures if available from third-party vendors; monitor for exploitation attempts. Note: Compensating controls reduce but do not eliminate risk—device replacement is strongly recommended.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint
Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achi
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary c
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitra
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote at
Exploit-DB