Cyber Resilience

CVE-2025-70249

HighPublic PoC

Published: 10 March 2026

Published
10 March 2026
Modified
11 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0009 26.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70249 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-70249 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSetWizard2 endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for significant availability disruption.

Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no authentication privileges or user interaction. Exploitation triggers a stack buffer overflow, resulting in denial-of-service conditions such as device crashes or reboots, with no direct impact on confidentiality or integrity.

For mitigation guidance, refer to the following resources: the CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70249, D-Link DIR-513 product support at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and D-Link's security bulletin page at https://www.dlink.com/en/security-bulletin/. Security practitioners should check these for firmware updates or advisories.

EU & UK References

Vulnerability details

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizard2.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Vulnerability directly enables remote unauthenticated exploitation of a public-facing web endpoint (formSetWizard2), causing DoS via stack buffer overflow (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-70243Same product: Dlink Dir-513
CVE-2025-70250Same product: Dlink Dir-513
CVE-2025-70238Same product: Dlink Dir-513
CVE-2025-70251Same product: Dlink Dir-513
CVE-2025-70227Same product: Dlink Dir-513
CVE-2025-70247Same product: Dlink Dir-513
CVE-2025-70223Same product: Dlink Dir-513
CVE-2025-70246Same product: Dlink Dir-513
CVE-2025-70232Same product: Dlink Dir-513
CVE-2025-70218Same product: Dlink Dir-513

Affected Assets

dlink
dir-513 firmware
1.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the stack buffer overflow by requiring timely flaw remediation through firmware updates for the affected D-Link DIR-513 router.

SI-10 Information Input Validation good match
prevent

Prevents the buffer overflow by enforcing validation of the curTime parameter in the goform/formSetWizard2 endpoint to reject malformed inputs.

SI-16 Memory Protection good match
prevent

Implements memory protections such as stack canaries and DEP to block exploitation of the stack buffer overflow even if invalid input reaches the vulnerable code.

References