| Title | D-Link DIR-513 1.10 Buffer Overflow |
|---|
| Description | Stack-based Buffer Overflow in D-Link DIR-513 formSetDDNS function Description: D-Link DIR-513 devices (A1 FW110, A2 FW110) contain a stack-based buffer overflow vulnerability in the formSetDDNS function of the web management interface (at offset 0x466fdc). The vulnerability arises when the application processes the curTime parameter from an HTTP POST request. The program retrieves this user-controlled value via websGetVar and passes it to an unsafe sprintf call at address 0x467720 to format a string into a fixed-size 128-byte stack buffer (v31).
Due to the lack of boundary checks, an attacker can provide a specially crafted curTime value exceeding the buffer capacity to overwrite the return address on the stack (located 160 bytes away from the buffer start). This can lead to a Denial of Service (DoS) or arbitrary Remote Code Execution (RCE) with elevated privileges. Additionally, a secondary risk exists at address 0x4676e4, where a strcpy operation can further propagate the overflow into the err_msg global buffer. |
|---|
| Source | ⚠️ https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetDDNS |
|---|
| User | AttackingLin (UID 88138) |
|---|
| Submission | 03/06/2026 04:56 (7 months ago) |
|---|
| Moderation | 03/20/2026 09:27 (14 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 349229 [D-Link DIR-513 1.10 /goform/formSetDDNS curTime stack-based overflow] |
|---|
| Points | 0 |
|---|