CVE-2026-120189
Stack-based buffer overflow in D-Link DIR-505 TFTP service
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
Stack-based buffer overflow in the TFTP Upload Filename Handler of D-Link DIR-505 1.10B02. It can be triggered remotely without authentication by manipulating the upload filename. Attackers can gain arbitrary code execution. All users of the vulnerable firmware are affected.
What to do: Upgrade to a fixed D-Link DIR-505 firmware version. Apply D-Link update for CVE-2026-120189
| Product | Affected |
|---|---|
| D-Link DIR-505 | 1.10B02 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
- Weakness
- CWE-119, CWE-121
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.