A critical stack-based buffer overflow in the D-Link DIR-513 router allows for potential remote code execution, posing a severe risk to network infrastructure.

The vulnerability exists in the formWPS callback function, which fails to validate the length of the webpage parameter provided in POST requests to the /goform/formWPS endpoint. This lack of input sanitization allows an attacker to overwrite memory and trigger a stack-based buffer overflow via the strcpy and sprintf functions.

Successful exploitation of this vulnerability could allow an unauthenticated or low-privileged remote attacker to execute arbitrary code on the affected router. Given that this device serves as a network gateway, compromise could lead to full loss of network control, interception of sensitive traffic, or redirection of internal traffic to malicious destinations. The CVSS score of 8.8 reflects the high severity of this flaw, particularly as it affects core routing infrastructure.

Immediate Action: Because this device is confirmed to be end-of-life and no patch is available, the primary remediation is to decommission the affected hardware immediately and replace it with a supported device.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formWPS endpoint, which may indicate attempted exploitation.

Compensating Controls: If the device cannot be immediately replaced, isolate the router from the public internet using a firewall or restrictive access control lists to prevent external access to the administrative web interface.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided by the researcher on GitHub.

Given that the vendor no longer supports this product, there is no expectation of a security patch. Organizations currently utilizing the D-Link DIR-513 should prioritize the immediate retirement and replacement of this hardware. Continued use of this device in any production environment is strongly discouraged due to the presence of a publicly available exploit and the high probability of successful remote exploitation.