PT-2026-26619 · D Link · Dir-513

Attackinglin · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-4486

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-513 version 1.10

Description A stack-based buffer overflow exists in the Web Service component of D-Link DIR-513 version 1.10. The issue is located in the formEasySetPassword function within the /goform/formEasySetPassword file. Manipulation of the curTime argument can trigger the overflow. This issue can be exploited remotely and an exploit has been made public. The vulnerability affects products that are no longer supported by the maintainer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Memory Corruption

Buffer Overflow

Enumeração de Fraquezas

CWE-121

CWE-787

CWE-119

Identificadores relacionados

CVE-2026-4486

Produtos afetados

Dir-513

Referências · 15

• 🔥 https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/poc.py · Exploit
• 🔥 https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formEasySetPassword/formEasySetPassword.md · Exploit
• https://twitter.com/CVEnew/status/2035626977923596742 · Publicação no Twitter
• https://twitter.com/ptdbugs/status/2035201659131887952 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2035004207233728534 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4486 · Nota de Segurança
• https://twitter.com/vuldb/status/2035253379040256252 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2035099155954376981 · Publicação no Twitter
• https://dlink.com · Nota
• https://reddit.com/r/pwnhub/comments/1rzbz9i/urgent_cybersecurity_alert_dlink_dir513_buffer · Publicação no Reddit
• https://vuldb.com/?id.352009 · Nota
• https://vuldb.com/?submit.773566 · Nota
• https://vuldb.com/?submit.773537 · Nota
• https://vuldb.com/?ctiid.352009 · Nota
• https://twitter.com/RedPacketSec/status/2035158531674947660 · Publicação no Twitter