Cyber Posture

CVE-2025-70238

HighPublic PoC

Published: 09 March 2026

Published
09 March 2026
Modified
11 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0009 25.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70238 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated exploitation of web management interface (public-facing app) via crafted parameter causing stack overflow and device crash/DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard52.

Deeper analysisAI

CVE-2025-70238 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetWAN_Wizard52 endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-03-09T15:15:52.460.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation results in high availability impact, enabling denial-of-service conditions such as device crashes, while confidentiality and integrity remain unaffected.

Mitigation details are available in vendor advisories, including the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70238.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

CVEs Like This One

CVE-2025-70251Same product: Dlink Dir-513
CVE-2025-70247Same product: Dlink Dir-513
CVE-2025-70249Same product: Dlink Dir-513
CVE-2025-70227Same product: Dlink Dir-513
CVE-2025-70250Same product: Dlink Dir-513
CVE-2025-70243Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70222Same product: Dlink Dir-513
CVE-2025-70226Same product: Dlink Dir-513
CVE-2025-70230Same product: Dlink Dir-513

References