{"id":"CVE-2026-120189","kind":"vulnerability","aliases":["CVE-2026-120189"],"related":[],"title":"D-Link DIR-505 router: remote stack overflow in TFTP upload handler","description":"A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.","summary":"A stack-based buffer overflow in the TFTP upload filename handler of the D-Link DIR-505 router firmware (version 1.10B02) can be triggered remotely. The sources say a public exploit exists, so an attacker may be able to run code on the device.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DIR-505","fixed":[],"affected":"1.10B02","ecosystem":"vendor"}],"ecosystems":[],"tags":["d-link","dir-505","end-of-life","firmware","infrastructure","router","tftp"],"not_affected_if":["other-firmware-versions","tftp-unreachable"],"how_to_check":"- Admin page > Status/Firmware: version 1.10B02 is the only version named as affected (other versions are untested, not cleared).\n- Check whether the router's TFTP service (/usr/bin/tftpd, UDP 69) answers from the WAN or from untrusted LAN/Wi-Fi clients.\n- Also check any DIR-505L or other units on the same firmware base; no source confirms them.","fix":"No fix: D-Link ended support for the DIR-505 on 2018-01-31 and issues no firmware updates. Retire and replace the router; until then do not expose it to untrusted networks.","status":"open","published_at":"2026-11-01T01:17:16+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","triaged_at":"2026-11-01T01:47:35+00:00","updated_at":"2026-11-01T01:48:38+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-01T01:47:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"D-Link DIR-505 router: remote stack overflow in TFTP upload handler","impact":"high","summary":"A stack-based buffer overflow in the TFTP upload filename handler of the D-Link DIR-505 router firmware (version 1.10B02) can be triggered remotely. The sources say a public exploit exists, so an attacker may be able to run code on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["d-link","dir-505","router","firmware","tftp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker may run code on the router","analyst_note":"Check the NVD entry and D-Link's advisory for a fixed firmware version and whether TFTP upload is enabled by default.","how_to_check":"- Check the firmware version on the device admin page; the sources name `1.10B02` as affected\n- Check whether the TFTP upload service (`/usr/bin/tftpd`) is reachable from outside the network\n- unknown for any other check the sources do not describe","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","tftp-unreachable"],"who_is_affected":"The sources name only D-Link DIR-505 firmware 1.10B02 and its TFTP upload filename handler (save_upload_file/mp_upload_file in /usr/bin/tftpd). Devices running that firmware with the TFTP service reachable from the network are the ones to look at; devices on other firmware versions or with the service unreachable are not named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4138,"output_tokens":598,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and D-Link's advisory for a fixed firmware version and whether TFTP upload is enabled by default.","search":"'-120189':16A,19A '-2026':15A,18A '-505':5A,21A,26B,53B,91C '/usr/bin/tftpd':104C '1.10':57B,92C 'abl':75B 'affect':94C 'attack':72B,122C 'avail':134C 'b02':58B,93C 'base':38B,118C 'buffer':39B,119C 'carri':127C 'code':78B 'compon':107C 'cve':14A,17A 'd':2A,23B,50B,88C 'd-link':1A,22B,49B,87C 'devic':81B 'dir':4A,20A,25B,52B,90C 'end':28B 'end-of-lif':27B 'exist':69B 'exploit':68B,131C 'file':103C 'file/mp_upload_file':100C 'filenam':45B,110C 'firmwar':31B,55B 'function':97C 'handler':13A,46B,111C 'identifi':85C 'infrastructur':32B 'lead':114C 'life':30B 'link':3A,24B,51B,89C 'manipul':113C 'may':73B 'might':136C 'overflow':9A,40B,120C 'possibl':124C 'public':67B,133C 'remot':7A,62B,129C 'router':6A,33B,54B 'run':77B 'save':98C 'say':65B 'sourc':64B 'stack':8A,37B,117C 'stack-bas':36B,116C 'tftp':11A,34B,43B,108C 'trigger':61B 'upload':12A,44B,99C,109C 'use':138C 'version':56B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"D-Link DIR-505 routers running firmware 1.10B02 are the only confirmed affected device. VulDB says the flaw is reachable remotely without authentication, so look at any such router whose TFTP service can be reached from the internet or from untrusted network clients. D-Link ended support for this model in 2018, so owners can skip it only by retiring the device.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Replace your D-Link DIR-505 router with a model that still gets security updates, because D-Link no longer supports it.","first_public_at":"2026-11-01T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120189","severity":null,"published_at":"2026-11-01T01:17:16+00:00","modified_at":"2026-11-01T01:17:16+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","fetched_at":"2026-11-01T01:47:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120189:1269","url":null,"severity":null,"published_at":"2026-11-01T01:48:38+00:00","modified_at":"2026-11-01T01:48:38+00:00","first_seen_at":"2026-11-01T01:48:38+00:00","fetched_at":"2026-11-01T01:48:38+00:00","note":"No D-Link advisory for this CVE. Details from VulDB (CNA) and NVD: PoC said to be on GitHub (link not visible, not saved); not seen exploited. D-Link legacy page confirms DIR-505 EOL 2018-01-31, so fix=none (inferred from EOL, not a CVE-specific vendor statement). Nothing verified. Social search skipped."}],"documents":[{"id":36127,"url":"https://vuldb.com/vuln/429528","title":"VulDB VDB-429528: D-Link DIR-505 1.10B02 TFTP stack overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":36128,"url":"https://legacy.us.dlink.com/pages/product.aspx?id=bfae1a942f86457cb0a75250b5364116","title":"D-Link Legacy Products: DIR-505, last day of support 1/31/2018","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":36129,"url":"http://legacyfiles.us.dlink.com/DIR-505/REVA/DIR-505_END_OF_SUPPORT_NOTICE.pdf","title":"D-Link DIR-505 End of Support Notice","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}