Cyber Resilience

CVE-2025-70232

CriticalPublic PoC

Published: 05 March 2026

Published
05 March 2026
Modified
06 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0063 45.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-70232 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-70232 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetMACFilter endpoint. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical, and was published on 2026-03-05T19:16:01.200.

An unauthenticated remote attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation enables high-impact consequences across confidentiality, integrity, and availability, potentially resulting in arbitrary code execution on the device.

D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/ and product support page for DIR-513 at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513 provide relevant advisory information. Further technical details, including a proof-of-concept, are documented in the GitHub repository https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70232.

EU & UK References

Vulnerability details

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a critical unauthenticated stack buffer overflow in a public-facing router web interface (goform/formSetMACFilter endpoint), directly enabling remote code execution via T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-70218Same product: Dlink Dir-513
CVE-2025-70233Same product: Dlink Dir-513
CVE-2025-70244Same product: Dlink Dir-513
CVE-2025-70230Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70242Same product: Dlink Dir-513
CVE-2025-70223Same product: Dlink Dir-513
CVE-2025-70225Same product: Dlink Dir-513
CVE-2025-70229Same product: Dlink Dir-513
CVE-2025-70222Same product: Dlink Dir-513

Affected Assets

dlink
dir-513 firmware
1.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly validates the curTime parameter to block malformed inputs that trigger the stack buffer overflow.

SI-16 Memory Protection good match
prevent

Implements memory protections like stack canaries to prevent arbitrary code execution even if the buffer overflow occurs.

SI-2 Flaw Remediation good match
preventrecover

Ensures timely patching of the vulnerable firmware in D-Link DIR-513 to remediate the stack buffer overflow flaw.

References