CVE-2025-70237
Published: 03 March 2026
Summary
CVE-2025-70237 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and patching of the stack buffer overflow flaw in the goform/formSetPortTr endpoint via firmware updates.
Prevents exploitation of the stack buffer overflow by enforcing validation of the curTime parameter to block out-of-bounds memory writes.
Mitigates stack buffer overflow impacts through memory protections like stack canaries or address space layout randomization to limit arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public-facing web management endpoint (goform/formSetPortTr) directly enables exploitation of a network device via T1190.
NVD Description
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr.
Deeper analysisAI
CVE-2025-70237 is a stack buffer overflow vulnerability (CWE-787, CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetPortTr endpoint, enabling out-of-bounds memory writes on the stack.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction required. Exploitation could grant high-impact access to confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system crashes.
Mitigation guidance and patches may be detailed in D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report repository at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70237. Security practitioners should consult these sources for firmware updates or workarounds.
Details
- CWE(s)