CVE-2025-70221
Published: 04 March 2026
Summary
CVE-2025-70221 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents stack buffer overflow by requiring validation of the curTime parameter in the goform/formLogin endpoint.
Mitigates exploitation of the stack buffer overflow through memory safeguards such as stack canaries and non-executable stacks.
Addresses the CVE by mandating timely remediation via vendor patches for the D-Link DIR-513 v1.10 firmware vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in public-facing router web endpoint (goform/formLogin) allows remote unauthenticated exploitation for arbitrary code execution, directly mapping to T1190: Exploit Public-Facing Application.
NVD Description
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.
Deeper analysisAI
CVE-2025-70221 is a stack buffer overflow vulnerability (CWE-121) affecting the D-Link DIR-513 router in version 1.10. The issue arises in the handling of the curTime parameter sent to the goform/formLogin endpoint, allowing attackers to trigger a buffer overflow condition. Published on 2026-03-04, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with no privileges required. Successful exploitation enables high-impact outcomes, including arbitrary code execution, data disclosure, modification of system integrity, and denial of service, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Mitigation details and advisories are available through vendor resources, including the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/, product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70221. Security practitioners should consult these for patch availability and recommended actions specific to the DIR-513.
Details
- CWE(s)