EUVD-2026-16969
GHSA-f739-9xv4-c36c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to D-Link DIR-513 web interface
-
DeliverySend crafted request to /goform/formSetEmail
-
ExploitInject oversized curTime parameter
-
ExecutionTrigger stack buffer overflow
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | D-Link DIR-513 firmware version 1.10. Requires authenticated access to the web interface (/goform/formSetEmail endpoint). Attacker must be a logged-in user with credentials. Crafted curTime parameter triggers stack-based buffer overflow in formSetEmail function. Product is end-of-life and no longer supported. |
| Impact | Real-world risk is HIGH despite requiring authenticated access (PR:L). The CVSS v3.1 base score of 8.8 reflects network-accessible attack vector (AV:N), low complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). The Exploit Maturity indicator (E:P for Proof-of-Concept) combined with confirmed public exploit code on GitHub means any attacker with basic skills can weaponize this vulnerability immediately. Authentication requirement is a minor barrier since D-Link routers historically ship with default credentials (admin/blank or admin/admin), and many users never change them. The CRITICAL aggravating factor is D-Link's end-of-life status for DIR-513 (RL:X - no remediation available), meaning deployed devices will remain vulnerable indefinitely. No CISA KEV listing indicates no confirmed large-scale exploitation campaigns yet, but the combination of public POC, remote access, and permanent unfixable status makes this a high-priority risk for any organization still operating these devices. SSVC assessment: Exploitation=POC, Automatable=yes (default creds common), Technical Impact=total (complete device takeover). Decision: IMMEDIATE action required. |
| Exploit ScenarioDerived | An attacker discovers a D-Link DIR-513 router exposed on the internet via Shodan or similar scanning, attempts common default credentials (admin/blank), successfully authenticates to the web interface, and accesses the email configuration page at /goform/formSetEmail. The attacker crafts a malicious HTTP POST request with an oversized curTime parameter containing shellcode and return address overwrites, triggering the stack-based buffer overflow when formSetEmail processes the input. Successful exploitation grants the attacker root-level code execution on the router's embedded Linux OS, allowing installation of persistent backdoors, traffic interception, DNS hijacking, or pivot attacks into the internal network. The publicly available proof-of-concept code on GitHub provides ready-made exploitation tools, reducing the required attacker skill level to script-kiddie tier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 29, 2026
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability affects the formSetEmail function via manipulation of the curTime parameter. Publicly available exploit code exists on GitHub, significantly lowering the exploitation barrier. CRITICAL LIMITATION: This product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices. CVSS 8.8 with low attack complexity and CVSS:3.1 Exploit Maturity 'Proof-of-Concept' confirms immediate exploitability.
RemediationAI
No vendor-released patch exists and none will be developed as D-Link DIR-513 has reached end-of-life with no ongoing security support (CVSS Remediation Level: X). The ONLY effective remediation is immediate hardware replacement with a currently supported router model from D-Link or another vendor that receives active security updates. INTERIM RISK REDUCTION measures for devices that cannot be immediately replaced: (1) Disable remote administration interfaces and ensure the web management interface is accessible only from trusted internal networks, not the internet; (2) Change all default credentials immediately to strong unique passwords; (3) Implement network segmentation to isolate DIR-513 devices from critical assets; (4) Monitor logs for unusual authentication attempts or configuration changes to the /goform/formSetEmail endpoint; (5) Consider placing the device behind a more secure firewall or gateway that can filter malicious requests. Organizations should reference D-Link's end-of-life policy at https://www.dlink.com/ and prioritize budget for hardware lifecycle management. The public exploit repository at https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_30/README.md should be reviewed to understand attack indicators for detection purposes only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the formSetEmail function within the /goform/formSetEmail endpoint of D-Link DIR-513 firmware version 1.10, a wireless router product. CWE-121 (Stack-based Buffer Overflow) indicates that user-controlled input to the 'curTime' parameter is copied to a fixed-size stack buffer without proper bounds checking. When excessive data is supplied, adjacent memory is overwritten, potentially including return addresses or function pointers. In embedded Linux devices like consumer routers, successful stack overflow exploitation typically allows attackers to redirect execution flow, execute shellcode, or invoke existing functions (ROP chains) to gain complete control over the device's operating system. The affected CPE (cpe:2.3:a:d-link:dir-513:*:*:*:*:*:*:*:*) confirms this targets the DIR-513 application firmware across all patch levels, with version 1.10 specifically identified.
Know when Dir 513 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
D-Link DIR-513 routers (v1.10) contain a stack-based buffer overflow in the email configuration interface that allows authenticated attackers to execute arbitrary code, compromising network confidentiality, integrity, and availability. Since this product is end-of-life and will not receive security updates from D-Link, any deployed devices represent a permanent and unmitigatable risk requiring immediate replacement or isolation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative interface access via firewall rules to trusted IP ranges only; (2) Disable email configuration functionality if not actively used; (3) Enforce strong authentication credentials for any administrative access; (4) Implement network segmentation to isolate router management traffic. However, these controls do not eliminate the vulnerability-device replacement is the only permanent remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in D-Link and Tenda Router Stack Overflow Flaws
View all 2Remote code execution in D-Link DIR-513 1.10 via stack-based buffer overflow in the /goform/formEasySetPassword endpoint
Buffer overflow in D-Link DIR-513 firmware 1.10 formAdvanceSetup function enables authenticated remote attackers to achi
Buffer overflow in D-Link DIR-513 1.10 POST request handler allows authenticated remote attackers to achieve arbitrary c
Buffer overflow in D-Link DIR-513 1.10 formSetPassword function allows authenticated remote attackers to achieve arbitra
Remote code execution in D-Link DIR-513 1.10 through stack-based buffer overflow in the /goform/formEasySetTimezone endp
Exploit-DB