Cyber Posture

CVE-2025-70243

HighPublic PoC

Published: 09 March 2026

Published
09 March 2026
Modified
11 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0009 25.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70243 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Unauthenticated network exploitation of public web endpoint (formSetWAN_Wizard534) directly enables T1190; resulting stack overflow produces application/system crash matching T1499.004.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.

Deeper analysisAI

CVE-2025-70243 is a stack buffer overflow vulnerability, classified under CWE-121, affecting the D-Link DIR-513 router in version 1.10. The flaw occurs in the processing of the curTime parameter sent to the goform/formSetWAN_Wizard534 endpoint. Published on 2026-03-09, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption without confidentiality or integrity impacts.

Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Exploitation triggers a stack buffer overflow, enabling a denial-of-service condition that crashes the affected component and disrupts device availability.

Mitigation guidance and patches may be available through D-Link's security resources, including the security bulletin at https://www.dlink.com/en/security-bulletin/, the DIR-513 product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a detailed report on GitHub at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70243. Security practitioners should consult these for firmware updates or workarounds.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

CVEs Like This One

CVE-2025-70251Same product: Dlink Dir-513
CVE-2025-70247Same product: Dlink Dir-513
CVE-2025-70249Same product: Dlink Dir-513
CVE-2025-70227Same product: Dlink Dir-513
CVE-2025-70250Same product: Dlink Dir-513
CVE-2025-70238Same product: Dlink Dir-513
CVE-2025-70219Same product: Dlink Dir-513
CVE-2025-70222Same product: Dlink Dir-513
CVE-2025-70226Same product: Dlink Dir-513
CVE-2025-70230Same product: Dlink Dir-513

References