CVE-2025-70243
Published: 09 March 2026
Summary
CVE-2025-70243 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-70243 is a stack buffer overflow vulnerability, classified under CWE-121, affecting the D-Link DIR-513 router in version 1.10. The flaw occurs in the processing of the curTime parameter sent to the goform/formSetWAN_Wizard534 endpoint. Published on 2026-03-09, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption without confidentiality or integrity impacts.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Exploitation triggers a stack buffer overflow, enabling a denial-of-service condition that crashes the affected component and disrupts device availability.
Mitigation guidance and patches may be available through D-Link's security resources, including the security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a detailed report on GitHub at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70243. Security practitioners should consult these for firmware updates or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208419
Vulnerability details
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated network exploitation of public web endpoint (formSetWAN_Wizard534) directly enables T1190; resulting stack overflow produces application/system crash matching T1499.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the stack buffer overflow vulnerability in D-Link DIR-513 v1.10 by applying vendor firmware patches for CVE-2025-70243.
Prevents the stack buffer overflow by enforcing input validation on the unauthenticated curTime parameter to the goform/formSetWAN_Wizard534 endpoint.
Protects against and limits the denial-of-service effects from the availability disruption caused by crashing the router component via the buffer overflow exploit.