CVE-2026-6013
Published: 10 April 2026
Summary
CVE-2026-6013 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dir-513 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates replacement or prohibition of unsupported system components like the EOL D-Link DIR-513 firmware with no patches available for CVE-2026-6013.
Requires validation of inputs like the curTime argument in the POST request handler to prevent the buffer overflow exploitation.
Implements memory protections such as ASLR or stack canaries to mitigate arbitrary code execution from the buffer overflow in formSetRoute.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web interface (formSetRoute) allows authenticated low-priv remote attacker to achieve RCE on the device.
NVD Description
A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. The attack may be performed from…
more
remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-6013 is a buffer overflow vulnerability in the D-Link DIR-513 router running firmware version 1.10. It affects the formSetRoute function within the /goform/formSetRoute file of the POST Request Handler component, where manipulation of the curTime argument triggers the overflow. The issue corresponds to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation by an authenticated attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation can result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution on the affected device. A public exploit is available, increasing the risk for vulnerable installations.
This vulnerability impacts only D-Link DIR-513 products that are no longer supported by the manufacturer, meaning no official patches or firmware updates are available. Security practitioners should consult advisories from sources like VulDB (e.g., vuldb.com/vuln/356569) and the D-Link website for confirmation, and consider network segmentation, access controls, or device retirement to mitigate exposure. The exploit's public availability heightens the urgency for unsupported legacy devices.
Details
- CWE(s)