CVE-2025-10792 Overview
CVE-2025-10792 is a buffer overflow vulnerability affecting the D-Link DIR-513 A1FW110 router. The flaw resides in an unknown function within the /goform/formWPS endpoint, where improper handling of the webpage argument allows attackers to overflow a buffer. Remote attackers can exploit the issue across the network, and a public proof-of-concept has been disclosed. The affected device is end-of-life and no longer supported by D-Link, meaning no official patch will be released. The vulnerability maps to [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and [CWE-787] (Out-of-bounds Write).
Critical Impact
Remote attackers can trigger a buffer overflow in the WPS handler of an unsupported D-Link DIR-513 router, potentially leading to memory corruption and arbitrary code execution on the device.
Affected Products
- D-Link DIR-513 hardware revision A1
- D-Link DIR-513 firmware version 1.10 (A1FW110)
- All end-of-life DIR-513 deployments (no vendor support)
Discovery Timeline
- 2025-09-22 - CVE-2025-10792 published to NVD
- 2025-10-08 - Last updated in NVD database
Technical Details for CVE-2025-10792
Vulnerability Analysis
The vulnerability exists in the /goform/formWPS handler of the DIR-513 web administration interface. When the device processes an HTTP request that includes the webpage argument, the firmware copies the user-supplied value into a fixed-size stack or heap buffer without validating the input length. Supplying an oversized value causes adjacent memory to be overwritten.
An attacker who can reach the device's web interface over the network may corrupt control data such as return addresses or function pointers. Successful exploitation can lead to denial of service or arbitrary code execution under the privileges of the embedded web server, which typically runs as root on consumer routers.
A public exploit write-up and proof-of-concept are available in the GitHub Vulnerability Report, increasing the likelihood of opportunistic exploitation against exposed devices.
Root Cause
The root cause is missing bounds checking on the webpage HTTP parameter before it is copied into an internal buffer. The handler trusts client-supplied input length, which is the underlying behavior described by [CWE-119] and [CWE-787]. D-Link has classified the DIR-513 as end-of-life, so the defect remains permanent in shipped firmware.
Attack Vector
The attack is performed remotely over the network against the router's HTTP management interface. The vulnerability requires low privileges, consistent with an authenticated or weakly authenticated web session against the WPS form. No user interaction is required.
The vulnerability is exploited by sending a crafted HTTP POST request to /goform/formWPS with an oversized webpage parameter. The excess bytes overflow the destination buffer and overwrite adjacent memory. Refer to the GitHub PoC for Vulnerability and VulDB #325149 Details for the disclosed request structure.
Detection Methods for CVE-2025-10792
Indicators of Compromise
- HTTP POST requests to /goform/formWPS containing unusually long webpage parameter values.
- Unexpected reboots, web service crashes, or httpd process restarts on DIR-513 routers.
- Outbound connections from the router to unknown infrastructure following inbound HTTP probes.
- Configuration changes to WPS, DNS, or firewall rules that were not initiated by an administrator.
Detection Strategies
- Inspect web server and reverse proxy logs for POST requests to /goform/formWPS with parameter lengths exceeding normal browser-generated values.
- Deploy network intrusion detection signatures that flag oversized form parameters targeting D-Link goform endpoints.
- Monitor router management interfaces for HTTP traffic originating from non-administrator source addresses.
Monitoring Recommendations
- Capture and review router syslog and crash logs for repeated httpd failures correlated with external HTTP activity.
- Track DNS and routing configuration drift on affected devices to detect post-exploitation tampering.
- Alert on any management-plane traffic to DIR-513 devices sourced from the WAN interface.
How to Mitigate CVE-2025-10792
Immediate Actions Required
- Remove DIR-513 routers from production networks, as they are end-of-life and will not receive a security patch.
- Disable remote/WAN management on the device until it can be replaced.
- Restrict access to the LAN-side management interface to a dedicated administrative VLAN or host.
- Replace affected hardware with a vendor-supported router that receives ongoing firmware updates.
Patch Information
No patch is available. D-Link has stated that the DIR-513 is no longer supported by the maintainer, and the vulnerability will not be fixed. Refer to the D-Link Official Site for end-of-life product notices and replacement guidance.
Workarounds
- Block inbound TCP traffic to the router's HTTP/HTTPS management ports at the upstream firewall.
- Disable WPS functionality on the device if the option is exposed in the administrative interface.
- Segment the router onto an isolated network that cannot reach sensitive internal assets.
- Plan and execute hardware replacement as the only durable remediation.
# Example upstream firewall rules to block inbound management access
# Adjust interface names and router IP to match your environment
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
