Cyber Posture

CVE-2025-70222

CriticalPublic PoC

Published: 04 March 2026

Published
04 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly enforces validation of the curTime parameter at login endpoints to prevent stack buffer overflows from malformed input.

prevent

Implements stack canaries and memory protections to detect and block exploitation of the stack buffer overflow vulnerability.

prevent

Mandates timely remediation of the specific stack buffer overflow flaw in D-Link DIR-513 firmware via vendor patches.

Security SummaryAI

CVE-2025-70222 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the /goform/formLogin or /goform/getAuthCode endpoints, potentially leading to buffer overrun conditions during processing.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity, requiring no privileges or user interaction. Remote unauthenticated attackers can trigger the overflow, achieving high impacts on confidentiality, integrity, and availability, such as arbitrary code execution and complete router compromise.

Mitigation guidance and patches are referenced in vendor advisories, including D-Link's security bulletin at https://www.dlink.com/en/security-bulletin/, product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70222. The CVE was published on 2026-03-04T22:16:12.050.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remotely exploitable stack buffer overflow in a public-facing web interface (/goform endpoints) on a router, enabling unauthenticated arbitrary code execution, directly mapping to Exploitation of Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References