home / blog
2026-11-01 · critical
CVE-2026-120189: Critical Stack Overflow in D-Link DIR-505
Critical buffer overflow (CVSS 10.0) in D-Link DIR-505 1.10B02 TFTP. Remote access, public exploit available.
CVE-2026-120189 is a stack-based buffer overflow in the TFTP Upload Filename handler (/usr/bin/tftpd) of D-Link DIR-505 firmware 1.10B02. The flaw enables remote attack through filename manipulation during TFTP upload. Published November 1, 2026, it directly affects administrators managing these routers, with CVSS 10.0.
The vulnerability is classified critical (CVSS 10.0), the highest severity level. According to NVD, an exploit is already publicly available. No patched firmware version is reported yet. Social signals (3 posts in 24 hours) confirm consistent spreading aligned with official sources, indicating a real, verified vulnerability.
Administrators managing D-Link DIR-505 must immediately check for updated firmware beyond version 1.10B02 from D-Link. Isolate or control access to the TFTP service, do not expose the router to the Internet, and monitor TFTP logs. If the device is critical, temporarily disable the TFTP upload service if not essential. Apply firewall rules to limit remote access.
At a glance
- What
- Stack-based buffer overflow in TFTP Upload Filename handler (/usr/bin/tftpd) of D-Link DIR-505 1.10B02. Remote access possible.
- Severity
- CVSS 10.0 (critical). Maximum severity level.
- Affected versions
- D-Link DIR-505 firmware 1.10B02
- Fix
- Not reported
- Status
- Public exploit available. No patch confirmed.
- Action
- Update firmware if available; isolate TFTP from Internet; monitor logs; disable TFTP upload if non-essential.
Sources: NVD, CVE-2026-120189