D-Link DIR-513 Buffer Overflow Vulnerability (CVE-2026-6012)

A buffer overflow vulnerability, CVE-2026-6012, has been identified in D-Link DIR-513 version 1.10. This vulnerability resides within the formSetPassword function of the /goform/formSetPassword component, specifically affecting the POST Request Handler. The vulnerability can be triggered by manipulating the curTime argument, leading to a buffer overflow condition. While a public exploit exists, it is important to note that the D-Link DIR-513 is no longer supported by the vendor. This vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial-of-service condition on the affected device. Given the end-of-life status of the device, patching is not a viable mitigation strategy.

Attack Chain

1. The attacker identifies a vulnerable D-Link DIR-513 device running firmware version 1.10.
2. The attacker crafts a malicious POST request targeting the /goform/formSetPassword endpoint.
3. Within the POST request, the attacker manipulates the curTime argument with a payload exceeding the expected buffer size.
4. The formSetPassword function processes the malicious POST request without proper bounds checking.
5. The oversized curTime argument overflows the allocated buffer, potentially overwriting adjacent memory regions.
6. The memory corruption leads to the execution of arbitrary code injected by the attacker.
7. The attacker gains control of the device, potentially gaining access to sensitive information or using the device as a bot in a larger attack.

Impact

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected D-Link DIR-513 device. Given the nature of the device, this could lead to unauthorized access to the network, data exfiltration, or the device being used as part of a botnet. While the device is no longer supported, there may still be vulnerable devices in operation, especially in home or small business networks.

Recommendation

• Deploy the Sigma rule Detect D-Link DIR-513 formSetPassword Buffer Overflow Attempt to detect exploitation attempts targeting the vulnerable endpoint (webserver logs).
• Implement network segmentation to isolate potentially vulnerable D-Link DIR-513 devices from critical network resources.
• Since the device is end-of-life, consider replacing the device with a supported and patched alternative to fully remediate the vulnerability.
• Monitor web server logs for POST requests to /goform/formSetPassword to identify potential exploitation attempts.