CVE-2025-70231
Published: 05 March 2026
Summary
CVE-2025-70231 is a critical-severity Path Traversal (CWE-22) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the path traversal vulnerability by requiring validation of the FILECODE parameter to reject traversal sequences like '../' and ensure only intended paths are processed.
Enforces logical access controls on files and directories, mitigating unauthorized reads or writes resulting from unfiltered path traversal in the /goform/getAuthCode endpoint.
Mandates identification, reporting, and timely patching of the specific flaw in D-Link DIR-513 v1.10 as detailed in vendor advisories, eliminating the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in public-facing web endpoint of D-Link router enables remote unauthenticated exploitation of public-facing application (T1190), potentially allowing arbitrary file read/write/execution.
NVD Description
D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enters /goform/getAuthCode but fails to filter the value of the FILECODE parameter, resulting in a path traversal vulnerability.
Deeper analysisAI
CVE-2025-70231, published on 2026-03-05, is a critical path traversal vulnerability (CWE-22) in D-Link DIR-513 version 1.10. The flaw arises when the device processes POST requests related to verification codes via the /goform/formLogin endpoint, which forwards to /goform/getAuthCode without properly filtering the FILECODE parameter. This allows traversal outside intended directories. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no authentication privileges or user interaction. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary file read, write, or execution depending on the traversed paths.
Mitigation guidance and patches are referenced in vendor advisories, including D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a detailed report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70231.
Details
- CWE(s)