CVE-2025-10792
📋 TL;DR
This CVE describes a remote buffer overflow vulnerability in D-Link DIR-513 A1FW110 routers via the /goform/formWPS endpoint. Attackers can exploit this to potentially execute arbitrary code or crash the device. Only unsupported legacy products are affected.
💻 Affected Systems
- D-Link DIR-513 A1FW110
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Device crash causing denial of service, potentially requiring physical reset.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access.
🎯 Exploit Status
Public proof-of-concept available on GitHub, remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Disable WPS via web interface
allAccess router admin panel and disable Wi-Fi Protected Setup feature
N/A - GUI configuration only
Block external access to web interface
linuxConfigure firewall to block WAN access to router management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Immediately replace affected routers with supported models
- Isolate vulnerable devices in separate network segment with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via admin interface at 192.168.0.1 or 192.168.1.1Check Version:
curl -s http://192.168.0.1/ | grep -i 'dir-513' || telnet 192.168.0.1 80Verify Fix Applied:
No fix available; verify replacement with supported hardware📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/formWPS
- Device crash/reboot logs
- Unusual traffic patterns to router management interface
Network Indicators:
- HTTP POST requests to /goform/formWPS with large payloads
- Port 80/443 scans followed by exploitation attempts
SIEM Query:
source="router.log" AND (uri="/goform/formWPS" OR "buffer overflow" OR "device reboot")