A stack-based buffer overflow exists in the boa component’s formEasySetTimezone function of the D‑Link DIR‑513 firmware 1.10. The vulnerable argument curTime is not validated for length, allowing an attacker to overflow a stack buffer. This flaw, identified as CWE‑121 with associated memory corruption weaknesses (CWE‑119, CWE‑787), can result in arbitrary code execution or denial of service when triggered.

Only the DIR‑513 model running firmware build 1.10 is affected. All newer firmware releases and other D‑Link products are not mentioned as vulnerable in the statement.

The CVSS score of 8.7 indicates high severity. An EPSS estimate of less than 1 % suggests that exploitation is not yet common, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely by sending HTTP requests to /goform/formEasySetTimezone; a public exploit has already been released, making the risk tangible for exposed devices. It is inferred that the attacker must be able to reach the router from an external network to achieve exploitation.