CVE-2026-4555
Published: 22 March 2026
Summary
CVE-2026-4555 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates the curTime argument in the formEasySetTimezone function to prevent stack-based buffer overflow from malformed inputs.
Implements memory safeguards such as stack canaries or DEP to protect against arbitrary code execution from stack buffer overflows.
Prohibits or isolates use of end-of-life D-Link DIR-513 routers lacking vendor patches for this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing boa web server (/goform/formEasySetTimezone) enables remote authenticated RCE on network device (T1190); low-priv authenticated access escalates to full compromise via arbitrary code execution (T1068).
NVD Description
A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the component boa. This manipulation of the argument curTime causes stack-based buffer overflow. The attack can be initiated remotely.…
more
The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-4555 is a stack-based buffer overflow vulnerability in the D-Link DIR-513 router running firmware version 1.10. The issue resides in the formEasySetTimezone function within the /goform/formEasySetTimezone file of the boa web server component. It is triggered by manipulating the curTime argument, leading to potential overflow conditions. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs 119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), 121 (Stack-based Buffer Overflow), and 787 (Out-of-bounds Write).
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user on the device. Successful exploitation allows arbitrary code execution with high impacts on confidentiality, integrity, and availability, potentially enabling full compromise of the router. An exploit is publicly available, facilitating attacks against vulnerable devices.
Advisories from sources like VulDB indicate that the vulnerability affects only products no longer supported by D-Link, with no patches or official mitigations available. References point to detailed exploit information on GitHub and VulDB entries, while the D-Link website provides general product support details but no specific remediation for this end-of-life device.
In notable context, the public availability of the exploit increases the risk of real-world attacks on exposed, unsupported D-Link DIR-513 routers.
Details
- CWE(s)