CVE-2025-10792
Published: 22 September 2025
Summary
CVE-2025-10792 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents the buffer overflow in /goform/formWPS by validating and restricting the length and format of the 'webpage' argument to avoid memory corruption.
Mitigates exploitation of the buffer overflow vulnerability through memory protection mechanisms like address space randomization and non-executable memory regions.
Eliminates exposure to this unpatched vulnerability by prohibiting the use of end-of-life unsupported devices such as the D-Link DIR-513 router.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow vulnerability in the web interface (/goform/formWPS) of the D-Link DIR-513 router enables remote exploitation of a public-facing application.
NVD Description
A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the argument webpage leads to buffer overflow. The attack may be performed from remote. The exploit has been…
more
disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2025-10792 is a buffer overflow vulnerability affecting the D-Link DIR-513 router with firmware version A1FW110. The flaw exists in an unknown function within the /goform/formWPS file, where manipulation of the "webpage" argument triggers the overflow. It is classified under CWE-119, CWE-120, and CWE-787, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation results in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the targeted device.
No patches or official mitigations are available, as the product is no longer supported by the maintainer. Advisories note that a proof-of-concept exploit has been publicly disclosed on GitHub, which may facilitate active attacks.
This vulnerability only impacts end-of-life D-Link DIR-513 devices, and the public disclosure of the exploit heightens the risk for exposed, unpatched routers in environments where low-privilege remote access is possible.
Details
- CWE(s)