CVE-2026-120189
A vulnerability was identified in D-Link DIR-505 1.10B02
- Risk score
- 65/100
- CVSS
- 10.0 v3.1
- Published
- 1 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A stack-based buffer overflow vulnerability in the TFTP Upload Filename Handler of D-Link DIR-505 1.10B02 allows an attacker to potentially carry out remote attacks. An exploit is publicly available.
- Affected
- {'products': ['D-Link DIR-505'], 'packages': [], 'versions': ['1.10B02']}
- Fix
- Check the linked advisory for a fix, but as no version is given, it is unclear what version to upgrade to.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Last activity 1 Nov 2026. Patch Forecast updates every hour.