A critical stack-based buffer overflow vulnerability in D-Link DIR-513 firmware version 1.10 exposes the device to remote code execution or denial of service attacks.

The vulnerability exists within the /goform/formEasySetupWizard3 endpoint, which fails to perform bounds checking on the wan_connected parameter. An attacker with low privileges can trigger a stack-based buffer overflow by supplying an overly long string to this parameter, leading to memory corruption.

Successful exploitation of this flaw allows an attacker to execute arbitrary code on the affected router or crash the system, resulting in a complete loss of service. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device compromise, allowing attackers to intercept network traffic or pivot into the internal network.

Immediate Action: As no official patch is currently available, users should restrict access to the device management interface by placing it behind a firewall or disabling remote management features.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/formEasySetupWizard3 endpoint and review device logs for signs of repetitive crashes or unexpected reboots.

Compensating Controls: If the device must remain accessible, implement a Web Application Firewall (WAF) rule to block or truncate HTTP requests containing excessively long values in the wan_connected parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's technical write-up on GitHub.

This vulnerability poses a significant risk to the integrity and availability of the affected D-Link hardware. Given the availability of a public proof-of-concept and the potential for remote code execution, administrators must prioritize isolating affected devices from the internet immediately and monitor for vendor updates to address this memory corruption flaw.