Cyber Posture

CVE-2025-70225

CriticalPublic PoC

Published: 04 March 2026

Published
04 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring timely remediation of the stack buffer overflow through vendor firmware patches.

prevent

Prevents exploitation by enforcing validation of the curtime parameter inputs to the goform/formEasySetupWWConfig component, averting the buffer overflow.

prevent

Mitigates stack buffer overflow exploitation via memory protection mechanisms like stack canaries, ASLR, and DEP on the affected router firmware.

Security SummaryAI

CVE-2025-70225 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs in the goform/formEasySetupWWConfig component via manipulation of the curtime parameter. Published on 2026-03-04, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

An unauthenticated attacker with network access can exploit this vulnerability remotely with low attack complexity and no user interaction. Exploitation enables high-impact effects on confidentiality, integrity, and availability of the affected device.

Mitigation guidance and patches may be available through vendor resources, including the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/, product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a GitHub CVE report at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70225.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack buffer overflow in unauthenticated, public-facing web component (goform/formEasySetupWWConfig) of D-Link router directly enables exploitation of public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References