Cyber Resilience

CVE-2025-70230

CriticalPublic PoC

Published: 05 March 2026

Published
05 March 2026
Modified
06 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0078 51.3th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-70230 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-70230 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetDDNS endpoint, potentially leading to memory corruption when processing oversized input.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system crashes.

Vendor advisories and support resources for mitigation are referenced at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70230, https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and https://www.dlink.com/en/security-bulletin/. Security practitioners should consult these for firmware updates or workarounds specific to the DIR-513.

EU & UK References

Vulnerability details

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDDNS.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Stack buffer overflow in public-facing router web endpoint (goform/formSetDDNS) enables unauthenticated remote code execution, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-70218Same product: Dlink Dir-513
CVE-2025-70233Same product: Dlink Dir-513
CVE-2025-70244Same product: Dlink Dir-513
CVE-2025-70232Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70242Same product: Dlink Dir-513
CVE-2025-70223Same product: Dlink Dir-513
CVE-2025-70225Same product: Dlink Dir-513
CVE-2025-70229Same product: Dlink Dir-513
CVE-2025-70222Same product: Dlink Dir-513

Affected Assets

dlink
dir-513 firmware
1.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Validating the length and format of the curTime parameter directly prevents the stack buffer overflow in the goform/formSetDDNS endpoint of the D-Link DIR-513.

SI-16 Memory Protection good match
prevent

Implementing stack canaries, address space layout randomization, and non-executable stack protections prevents exploitation of the stack buffer overflow leading to code execution.

SI-2 Flaw Remediation good match
prevent

Applying vendor firmware updates that remediate the specific stack buffer overflow flaw comprehensively mitigates CVE-2025-70230.

References