CVE-2025-70245
Stack Buffer Overflow in D-Link DIR-513 via curTime Parameter
Publication date: 2026-03-12
Last updated on: 2026-03-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dir-513_firmware | 1.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-70245 is a stack buffer overflow vulnerability found in the D-Link DIR-513 router, specifically in firmware version v1.10. It occurs in the component that handles HTTP POST requests to the endpoint goform/formSetWizardSelectMode. The vulnerability arises because the curTime parameter is improperly processed using the unsafe sprintf function, which allows an attacker to send an excessively long string. This long string overwrites the stack buffer, causing a buffer overflow.
How can this vulnerability impact me? :
This vulnerability could potentially be exploited to execute arbitrary code on the affected device or cause a denial of service (DoS). An attacker can send a specially crafted POST request with a very long curTime value to trigger the stack buffer overflow, which may allow them to take control of the router or disrupt its normal operation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests sent to the endpoint goform/formSetWizardSelectMode on D-Link DIR-513 routers running firmware version v1.10.'}, {'type': 'paragraph', 'content': 'Specifically, detection involves checking for unusually long or malformed curTime parameter values in these POST requests, as the vulnerability is triggered by an excessively long string in this parameter.'}, {'type': 'paragraph', 'content': 'A practical approach is to capture network traffic and filter for POST requests to the vulnerable endpoint, then inspect the curTime parameter length.'}, {'type': 'list_item', 'content': 'Use a network packet capture tool like tcpdump or Wireshark to capture traffic to the router.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant HTTP POST requests: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <router_ip>) and (tcp[32:4] = 0x504f5354)))'"}, {'type': 'list_item', 'content': 'Use tools like grep or custom scripts to parse captured HTTP POST data for the endpoint goform/formSetWizardSelectMode and check the length of the curTime parameter.'}, {'type': 'paragraph', 'content': 'Alternatively, sending a crafted POST request with a very long curTime parameter as a test can help verify if the device is vulnerable.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the affected D-Link DIR-513 router, especially limiting HTTP POST requests to the goform/formSetWizardSelectMode endpoint.'}, {'type': 'paragraph', 'content': "If possible, disable remote management or access to the router's web interface from untrusted networks."}, {'type': 'paragraph', 'content': 'Monitor and block HTTP POST requests with unusually long curTime parameters to prevent exploitation attempts.'}, {'type': 'paragraph', 'content': 'Contact D-Link for firmware updates or patches addressing this vulnerability and apply them as soon as they become available.'}, {'type': 'paragraph', 'content': 'In the meantime, consider network segmentation or placing the device behind additional security controls such as firewalls or intrusion prevention systems.'}] [1]