Cyber Posture

CVE-2025-70229

CriticalPublic PoC

Published: 05 March 2026

Published
05 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the CVE by requiring timely remediation of the stack buffer overflow flaw through firmware patching as advised in vendor bulletins.

prevent

Prevents exploitation of the vulnerability by validating the curTime parameter input to the goform/formSchedule endpoint against expected formats and lengths.

prevent

Protects against stack buffer overflow execution by implementing memory safeguards such as stack canaries and non-executable memory regions in the router firmware.

Security SummaryAI

CVE-2025-70229 is a stack buffer overflow vulnerability (CWE-121) in D-Link DIR-513 router version 1.10. The flaw occurs via the curTime parameter sent to the goform/formSchedule endpoint, which can lead to overflow conditions when processing malformed input.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no requirement for user interaction. Exploitation can achieve high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, system compromise, or denial of service on affected devices.

Advisories and mitigation guidance are available through vendor resources, including the D-Link security bulletin at https://www.dlink.com/en/security-bulletin/, product support page at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-513, and a detailed CVE report on GitHub at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70229. Security practitioners should review these for patch availability and recommended actions.

Details

CWE(s)

Affected Products

dlink
dir-513 firmware
1.10

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remotely exploitable stack buffer overflow in a public-facing web endpoint on a D-Link router, directly enabling exploitation of a public-facing application for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References