CVE-2025-70234
Published: 03 March 2026
Summary
CVE-2025-70234 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of the curTime parameter in goform/formSetQoS requests to prevent stack buffer overflows from malformed inputs.
Implements memory protection mechanisms like stack canaries, ASLR, and DEP to mitigate exploitation of the stack buffer overflow vulnerability.
Mandates timely patching of the specific flaw in D-Link DIR-513 v1.10 as referenced in the vendor security bulletin to remediate CVE-2025-70234.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public web endpoint (goform/formSetQoS) directly enables T1190 Exploit Public-Facing Application for initial access and RCE on the device.
NVD Description
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS.
Deeper analysisAI
CVE-2025-70234 is a stack buffer overflow vulnerability in D-Link DIR-513 router version 1.10, triggered via the curTime parameter in requests to the goform/formSetQoS endpoint. It is associated with CWE-787 (Out-of-bounds Write) and CWE-121 (Stack-based Buffer Overflow). The vulnerability was published on 2026-03-03 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts.
A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the affected endpoint over the network, with low complexity and no user interaction required. Successful exploitation could grant high-level impacts on confidentiality, integrity, and availability, likely enabling arbitrary code execution and full router compromise.
Mitigation details are referenced in D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70234.
Details
- CWE(s)