CVE-2025-70241
Published: 03 March 2026
Summary
CVE-2025-70241 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces bounds checking and input validation on parameters like curTime to directly prevent stack buffer overflows from malformed user input.
Requires timely identification, reporting, and patching of flaws like this buffer overflow vulnerability via firmware updates.
Implements runtime memory protections such as stack canaries, ASLR, and DEP to mitigate unauthorized code execution from stack buffer overflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated stack buffer overflow in public-facing web endpoint enables arbitrary code execution via exploitation of a network-accessible application.
NVD Description
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.
Deeper analysisAI
CVE-2025-70241 is a stack buffer overflow vulnerability (CWE-787, CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter supplied to the goform/formSetWANType_Wizard5 endpoint, allowing memory corruption due to insufficient bounds checking on user input.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network with low complexity, requiring no authentication, privileges, or user interaction. Remote attackers can leverage it to achieve high-impact effects, including arbitrary code execution, data disclosure, modification of system integrity, or denial of service through device crashes.
Advisories and potential patches are referenced in D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a detailed GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70241. Security practitioners should consult these for firmware updates or workarounds.
Details
- CWE(s)