CVE-2025-70218
Published: 04 March 2026
Summary
CVE-2025-70218 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-70218 is a stack buffer overflow vulnerability (CWE-121) in the D-Link DIR-513 router version 1.10. The flaw is triggered via POST requests to the goform/formAdvFirewall component. Published on 2026-03-04, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation enables high-impact consequences across confidentiality, integrity, and availability, likely allowing remote code execution and complete compromise of the affected device.
Mitigation details are referenced in D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/ and the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513. Further technical analysis is available in the GitHub repository https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70218.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208284
Vulnerability details
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a stack buffer overflow in the web management interface (goform/formAdvFirewall) of a public-facing router, enabling unauthenticated remote code execution, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack buffer overflow vulnerability in DIR-513 v1.10 by applying vendor firmware patches from D-Link's security bulletin.
Mandates validation of POST inputs to the goform/formAdvFirewall component to block oversized or malformed data causing the buffer overflow.
Implements memory safeguards such as stack canaries and ASLR to hinder remote code execution from exploitation of the unauthenticated buffer overflow.