The formEasySetPassword endpoint on the /goform interface of the D‑Link DIR‑513 router contains a stack‑based buffer overflow. An attacker can send a malformed curTime parameter in an HTTP request. If the overflow occurs, the stack can be corrupted, allowing arbitrary code execution or a denial‑of‑service on the device. A proof‑of‑concept exploit has been released publicly.

Only devices with firmware 1.10 of the DIR‑513 series are vulnerable. That firmware version is no longer maintained by D‑Link and no official update is available. The affected devices run the DIR‑513 hardware in models a1 and a2.

The CVSS base score of 8.7 classifies the flaw as high severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalogue, yet the remote nature and public exploit mean that exposed routers are still at significant risk. An attacker only needs to send a crafted request to the /goform/formEasySetPassword path from outside the local network to trigger the overflow.