CVE-2025-70240
Published: 03 March 2026
Summary
CVE-2025-70240 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of information inputs such as the curTime parameter to directly prevent stack buffer overflows at the goform/formSetWAN_Wizard51 endpoint.
SI-16 enforces memory protections that mitigate stack buffer overflow exploitation, such as arbitrary code execution from the curTime parameter vulnerability.
SI-2 requires timely flaw remediation, including patching the stack buffer overflow in D-Link DIR-513 v1.10 firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow in public web management endpoint (goform/formSetWAN_Wizard51) directly enables exploitation of a public-facing application for arbitrary code execution.
NVD Description
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51.
Deeper analysisAI
CVE-2025-70240 is a stack buffer overflow vulnerability (CWE-787, CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetWAN_Wizard51 endpoint, which can be reached over the network.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, no privileges, no user interaction, and unchanged scope. Attackers require only network access to trigger the overflow, potentially achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution.
Vendor guidance on mitigation is referenced in the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70240. The vulnerability was published on 2026-03-03T21:15:57.287.
Details
- CWE(s)