Cyber Resilience

CVE-2025-70226

CriticalPublic PoC

Published: 04 March 2026

Published
04 March 2026
Modified
06 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0049 38.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-70226 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-70226 is a stack buffer overflow vulnerability (CWE-121) in the D-Link DIR-513 router version 1.10. The flaw occurs in the handling of the curTime parameter sent to the goform/formEasySetupWizard endpoint. Published on 2026-03-04, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

An unauthenticated attacker with network access can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation could result in high confidentiality, integrity, and availability impacts, such as arbitrary code execution on the affected device.

Mitigation details and advisories are referenced in sources including a GitHub repository at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70226, the D-Link DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and D-Link's security bulletin page at https://www.dlink.com/en/security-bulletin/.

EU & UK References

Vulnerability details

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Stack buffer overflow in unauthenticated web endpoint (goform/formEasySetupWizard) of public-facing router enables remote arbitrary code execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-70218Same product: Dlink Dir-513
CVE-2025-70233Same product: Dlink Dir-513
CVE-2025-70244Same product: Dlink Dir-513
CVE-2025-70232Same product: Dlink Dir-513
CVE-2025-70230Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70242Same product: Dlink Dir-513
CVE-2025-70223Same product: Dlink Dir-513
CVE-2025-70225Same product: Dlink Dir-513
CVE-2025-70229Same product: Dlink Dir-513

Affected Assets

dlink
dir-513 firmware
1.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates the stack buffer overflow by enforcing validation of the curTime parameter in the goform/formEasySetupWizard endpoint.

SI-16 Memory Protection good match
prevent

Provides memory protections such as stack canaries and address space layout randomization to prevent exploitation of the stack buffer overflow vulnerability.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation through firmware patching to eliminate the specific stack buffer overflow flaw in D-Link DIR-513 v1.10.

References