D-Link DIR-505: Hidden backdoor in Web Management CGI (CVE-2026-118579)
Summary
The D-Link DIR-505 router, firmware 1.10B02, contains a hidden backdoor in the main function of /secmark1524.cgi in its Web Management CGI. Per the CVE data, manipulating the argument accu/pass/code/hash/cmds can trigger the backdoor remotely. A public proof-of-concept exists, and the CVSS 4.0 base score is 8.9 (HIGH), with no privileges required according to the vector. The device is end-of-life, so no vendor fix is expected.
Affected
- D-Link DIR-505, firmware 1.10B02
- Web Management CGI, file /secmark1524.cgi
Fixed in
Unknown. No fixed version has been published, and the device is end-of-life.
Workaround
- No vendor mitigation exists.
- Keep the router's admin interface off untrusted networks and isolate affected devices.
- A WAF in front of the device is generally not practical on this device class.
Exploitation
- Public proof-of-concept: yes (VulDB status: Proof-of-Concept; CISA SSVC: exploitation poc, automatable yes, technical impact total).
- In the wild: not confirmed. The CVE is not reported in the CISA KEV catalog according to third-party trackers; this was not checked directly.
Our recommendation
- Check whether any DIR-505 is in use, especially any reachable from the internet.
- Replace end-of-life DIR-505 devices with a supported model; a firmware reflash is not a reliable fix.
- If the device was internet-reachable, treat it as potentially compromised: review settings, change all credentials and check the network for unknown connections.
- Monitor D-Link advisories and vendor support notices for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-118579 vuldb.com
- VulDB entry 428018 vuldb.com
- PoC repository (CVE references) github.com
- D-Link end-of-life notice SAP10198 supportannouncement.us.dlink.com
- D-Link DIR-505 product support support.dlink.com
- Strix CVE analysis www.strix.ai
- TheHackerWire CVE-2026-118579 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:25.
Original description (NVD)
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.