Vulnerabilities · 12h ago

D-Link DIR-505 overflow risks remote device compromise

The CVE Program records a remotely reachable stack-based buffer overflow in D-Link DIR-505 firmware 1.10B02, with public proof-of-concept code linked. The record rates the flaw critical.

The overflow is in the device’s TFTP upload filename handler: a remote request can trigger it while the device processes an upload filename. The record’s severity ratings indicate potential impact to the device’s confidentiality, integrity, and availability, but do not establish that attackers are exploiting it in the wild.

For operators of DIR-505 units running 1.10B02, the public proof of concept makes this specific firmware a known exposure. The record identifies no fixed version and provides no evidence that other D-Link models are affected, so the scope beyond this device remains unclear.

CVE-2026-120189

NVD KEV

Published Nov 1 by VulDB

CVSS 10 CRITICAL: a vulnerability was identified in D-Link DIR-505 1.10B02.

Timeline

Nov 1 Reported by CVE Program records

Sources

1 source covering this story

CVE Program records Nov 1
D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow

Entities

CVE-2026-120189

Part of the PlainSec briefing for 2026-11-01

Editions

Briefing for 2026-11-01

Vulnerabilities · 12h agoD-Link DIR-505 overflow risks remote device compromiseThe CVE Program records a remotely reachable stack-based buffer overflow in D-Link DIR-505 firmware 1.10B02, with public proof-of-concept code linked. The record rates the flaw critical.The overflow is in the device’s TFTP upload filename handler: a remote request can trigger it while the device processes an upload filename. The record’s severity ratings indicate potential impact to the device’s confidentiality, integrity, and availability, but do not establish that attackers are exploiting it in the wild.For operators of DIR-505 units running 1.10B02, the public proof of concept makes this specific firmware a known exposure. The record identifies no fixed version and provides no evidence that other D-Link models are affected, so the scope beyond this device remains unclear.