CVE-2025-10792: A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the…

PriorityP268high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

2.99%

85.9th percentile

A security vulnerability has been detected in D-Link DIR-513 A1FW110. Affected is an unknown function of the file /goform/formWPS. Such manipulation of the argument webpage leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
d-link	dir-513	—	—
dlink	dir-513_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/goform/formWPS↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link formWPS webpage Parameter Buffer Overflow Attempt (CVE-2025-10792)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:15; content:"/goform/formWPS"; fast_pattern; http.request_body; content:"webpage|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/panda666-888/vuls/blob/main/d-link/dir-513/formWPS.md#poc; reference:cve,2025-10792; classtype:web-application-attack; sid:2064881; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_09_23, cve CVE_2025_10792, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

webpage=<100+ bytes not containing &>

→Exploit arrives as an HTTP POST request to the exact URI /goform/formWPS (URI length is exactly 15 bytes). Match on POST method + URI bsize:15 to reduce false positives.
→The buffer overflow is triggered via the 'webpage' POST body parameter. Look for 'webpage=' followed by a value of 100 or more characters (not containing '&') in the request body.
→Traffic is expected in plaintext (not TLS-wrapped); deploy detection at the network perimeter and internally on segments hosting D-Link DIR-513 devices.
→Map to MITRE ATT&CK T1190 (Exploit Public-Facing Application) under tactic TA0001 (Initial Access).

·The vulnerability affects D-Link DIR-513 A1 FW1.10, a product that is end-of-life and will not receive a vendor patch. Mitigation must be network-based (block/isolate the device).
·The exploit PoC has been publicly disclosed; active exploitation should be assumed. Prioritise detection and isolation accordingly.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.