Vulnerabilities & Exploits

D-Link DIR-505 overflow risks remote device compromise

The CVE Program records a remotely reachable stack-based buffer overflow in D-Link DIR-505 firmware 1.10B02, with public proof-of-concept code linked. The record rates the flaw critical.

The overflow is in the device’s TFTP upload filename handler: a remote request can trigger it while the device processes an upload filename. The record’s severity ratings indicate potential impact to the device’s confidentiality, integrity, and availability, but do not establish that attackers are exploiting it in the wild.

For operators of DIR-505 units running 1.10B02, the public proof of concept makes this specific firmware a known exposure. The record identifies no fixed version and provides no evidence that other D-Link models are affected, so the scope beyond this device remains unclear.

1 source · 12h ago

CVE-2026-120189

NVD KEV

Published Nov 1 by VulDB

CVSS 10 CRITICAL: a vulnerability was identified in D-Link DIR-505 1.10B02.

Timeline

Sources

Part of the PlainSec briefing for 2026-11-01

Every edition of this story: D-Link DIR-505 overflow risks remote device compromise

More from today