CVE-2025-70225 in DIR-513
Summary
by MITRE • 03/04/2026
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/06/2026
The CVE-2025-70225 vulnerability represents a critical stack buffer overflow flaw discovered in D-Link DIR-513 wireless router firmware version 1.10. This vulnerability specifically affects the web interface component responsible for handling network configuration parameters through the goform/formEasySetupWWConfig endpoint. The issue arises when the router processes the curtime parameter, which is typically used to set or retrieve the current time configuration for wireless wide area network setup. The flaw exists within the input validation and memory management routines of the web server component that processes these administrative requests.
The technical exploitation of this vulnerability stems from improper bounds checking within the firmware's handling of user-supplied input data. When an attacker sends a maliciously crafted curtime parameter value to the affected endpoint, the system fails to properly validate the input length before copying it to a fixed-size stack buffer. This results in a classic stack buffer overflow condition where excess data overflows into adjacent memory locations, potentially corrupting the stack frame and allowing for arbitrary code execution. The vulnerability falls under the CWE-121 stack-based buffer overflow category and aligns with ATT&CK technique T1059.007 for command and script injection.
The operational impact of this vulnerability is severe as it provides remote attackers with the ability to execute arbitrary code on the affected router with the privileges of the web server process. This could lead to complete compromise of the network device, enabling attackers to modify network configurations, intercept traffic, establish persistent backdoors, or use the device as a pivot point for further attacks within the network. The vulnerability affects the router's administrative interface, making it particularly dangerous as it allows attackers to gain unauthorized access to network management functions. The specific component affected, goform/formEasySetupWWConfig, suggests this vulnerability could be exploited during routine configuration processes, potentially making exploitation more likely.
Mitigation strategies should include immediate firmware updates from D-Link to address the buffer overflow vulnerability, as well as network segmentation and access control measures to limit exposure of the affected device to untrusted networks. Network administrators should implement monitoring for unusual traffic patterns or attempts to access the vulnerable web interface component. The vulnerability highlights the importance of proper input validation and memory management in embedded systems, particularly those handling administrative functions. Additionally, organizations should consider implementing network access control lists to restrict access to the router's web interface and ensure that only authorized administrative personnel can access these critical management functions. The flaw demonstrates the necessity of applying security patches promptly and maintaining updated firmware versions to protect against known vulnerabilities in network infrastructure devices.