Vulnerabilities · 16h ago

Public exploit puts D-Link DIR-505 backdoor in reach

The CVE Program lists a remotely reachable backdoor in D-Link DIR-505 version 1.10B02 and says public exploit code is available for CVE-2026-118579. The record rates the flaw critical but does not report confirmed attacks.

The vulnerable function is in /secmark1524.cgi, part of the router’s web-management interface. A remote caller can manipulate its parameters to trigger the backdoor. The record does not explain what the backdoor then permits, though its ratings indicate confidentiality, integrity, and availability are all affected.

For operators with version 1.10B02 and web management reachable remotely, all three are in scope. The record names no fixed version or cleanup guidance, leaving the remediation path—and what access might persist after a compromise—unclear.

CVE-2026-118579

NVD KEV

Published Oct 29 by VulDB

CVSS 9.8 CRITICAL: a weakness has been identified in D-Link DIR-505 1.10B02.

Timeline

Oct 29 Reported by CVE Program records

Sources

1 source covering this story

CVE Program records Oct 29
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

Entities

CVE-2026-118579

Part of the PlainSec briefing for 2026-10-29

Editions

Briefing for 2026-10-29

Vulnerabilities · 16h agoPublic exploit puts D-Link DIR-505 backdoor in reachThe CVE Program lists a remotely reachable backdoor in D-Link DIR-505 version 1.10B02 and says public exploit code is available for CVE-2026-118579. The record rates the flaw critical but does not report confirmed attacks.The vulnerable function is in /secmark1524.cgi, part of the router’s web-management interface. A remote caller can manipulate its parameters to trigger the backdoor. The record does not explain what the backdoor then permits, though its ratings indicate confidentiality, integrity, and availability are all affected.For operators with version 1.10B02 and web management reachable remotely, all three are in scope. The record names no fixed version or cleanup guidance, leaving the remediation path—and what access might persist after a compromise—unclear.