CVE-2025-70239
Stack Buffer Overflow in D-Link DIR-513 WAN Wizard Module
Publication date: 2026-03-03
Last updated on: 2026-03-09
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-513_firmware | 1.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-70239 is a stack buffer overflow vulnerability found in the D-Link DIR-513 router, specifically in firmware version v1.10. The vulnerability exists in the component handling the endpoint goform/formSetWAN_Wizard55 and is triggered via the "curTime" parameter.'}, {'type': 'paragraph', 'content': 'The overflow occurs because the input provided in the "curTime" parameter is not properly limited in size before being processed by a vulnerable call to sprintf. This improper handling allows an attacker to overwrite the stack memory.'}, {'type': 'paragraph', 'content': 'A proof-of-concept exploit involves sending an excessively long string in the "curTime" parameter via an HTTP POST request to the /goform/formSetWAN_Wizard55 endpoint, causing the buffer overflow.'}] [1]
How can this vulnerability impact me? :
This vulnerability could potentially allow an attacker to execute remote code on the affected D-Link DIR-513 router or cause a denial of service condition.
Remote code execution means an attacker could gain control over the device, potentially manipulating its functions or using it as a foothold into a network.
Denial of service could disrupt the normal operation of the router, causing network outages or degraded performance.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests sent to the endpoint /goform/formSetWAN_Wizard55 on the D-Link DIR-513 router firmware v1.10.'}, {'type': 'paragraph', 'content': 'Specifically, detection involves checking for unusually long or malformed values in the "curTime" parameter within these POST requests, as this parameter triggers the stack buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical approach is to capture network traffic and filter for POST requests to /goform/formSetWAN_Wizard55, then inspect the "curTime" parameter length.'}, {'type': 'list_item', 'content': "Use a network packet capture tool like tcpdump or Wireshark to capture traffic on the router's interface."}, {'type': 'list_item', 'content': "Example tcpdump command to capture HTTP POST requests to the vulnerable endpoint: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'"}, {'type': 'list_item', 'content': 'Filter captured traffic for POST requests containing "/goform/formSetWAN_Wizard55" and inspect the "curTime" parameter for abnormally long strings.'}, {'type': 'paragraph', 'content': 'Alternatively, use web application firewall (WAF) logs or intrusion detection system (IDS) signatures to detect attempts to exploit this vulnerability by looking for oversized "curTime" parameter values in POST requests.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the vulnerable endpoint and filtering malicious traffic targeting the "curTime" parameter.'}, {'type': 'list_item', 'content': 'Block or limit external access to the /goform/formSetWAN_Wizard55 endpoint on the D-Link DIR-513 router.'}, {'type': 'list_item', 'content': 'Implement input validation or filtering on the router or network perimeter to reject HTTP POST requests with excessively long "curTime" parameter values.'}, {'type': 'list_item', 'content': 'Monitor network traffic for exploitation attempts and respond by blocking offending IP addresses.'}, {'type': 'paragraph', 'content': 'Ultimately, updating the router firmware to a version that patches this vulnerability is recommended once available.'}] [1]