Cyber Posture

CVE-2025-70227

HighPublic PoC

Published: 10 March 2026

Published
10 March 2026
Modified
11 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0009 25.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70227 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated stack buffer overflow in public web interface directly enables T1190 exploitation; resulting device crash maps to T1499.004 Application or System Exploitation for DoS impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the nextPage parameter to goform/formLanguageChange.

Deeper analysisAI

CVE-2025-70227 is a stack buffer overflow vulnerability (CWE-121) in the D-Link DIR-513 router version 1.10. The flaw occurs via the nextPage parameter sent to the goform/formLanguageChange endpoint, potentially allowing memory corruption due to insufficient bounds checking on user-supplied input.

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Exploitation can achieve high-impact denial of service, likely causing the device to crash or become unresponsive.

Mitigation details are referenced in D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70227.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

CVEs Like This One

CVE-2025-70251Same product: Dlink Dir-513
CVE-2025-70247Same product: Dlink Dir-513
CVE-2025-70249Same product: Dlink Dir-513
CVE-2025-70250Same product: Dlink Dir-513
CVE-2025-70238Same product: Dlink Dir-513
CVE-2025-70243Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70222Same product: Dlink Dir-513
CVE-2025-70226Same product: Dlink Dir-513
CVE-2025-70230Same product: Dlink Dir-513

References