---
id: "CVE-2026-118579"
kind: "vulnerability"
aliases: ["CVE-2026-118579"]
title: "D-Link DIR-505 router: web CGI flaw lets remote attackers plant a backdoor"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["d-link", "dir-505", "infrastructure", "routers", "self-hosted"]
not_affected_if: ["admin-interface-not-exposed", "other-models"]
published_at: "2026-10-28T23:17:09+00:00"
first_seen_at: "2026-10-28T23:35:49+00:00"
updated_at: "2026-10-28T23:36:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118579", "first_seen_at": "2026-10-28T23:35:49+00:00"}]
---

# D-Link DIR-505 router: web CGI flaw lets remote attackers plant a backdoor

A weakness in the main function of the /secmark1524.cgi web management script on the D-Link DIR-505 (firmware 1.10B02) lets an attacker manipulate the accu/pass/code/hash/cmds argument and create a backdoor. An attacker who can reach the router's web interface over the network can gain control of the device, and a public exploit is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router's admin page or in its status screen; the sources name version `1.10B02` as affected.
- Check whether the web management interface is reachable from the internet, e.g. from outside your network.
- Check the router for an unknown `/secmark1524.cgi` request in web server or access logs, if logs are kept.

## Fix

- unknown: the sources do not name a fixed firmware version or a vendor advisory.
- Until a fix is confirmed, disable remote web administration and restrict the admin interface to trusted internal addresses.
- Replace the device if the vendor does not publish a fix.

## Timeline

- 2026-10-28T23:35:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118579

## From the sources

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_