D-Link DIR-505: Stack-based buffer overflow in TFTP upload filename handler
Summary
A stack-based buffer overflow in the TFTP upload filename handling (function save_upload_file/mp_upload_file in /usr/bin/tftpd) affects the D-Link DIR-505 wireless router. The vulnerability is network-reachable and requires no authentication, so an attacker who can reach the TFTP service may be able to execute code on the device. A public proof-of-concept exists. D-Link has discontinued this model and no vendor fix has been found.
Affected
- D-Link DIR-505, firmware 1.10B02 (per VulDB and the public PoC)
- The affected hardware revision is unverified.
Fixed in
- Unknown. No fixed version or D-Link advisory has been found.
Workaround
- No vendor workaround is known.
- Remove the device from the internet.
- Block inbound UDP 69 (TFTP) and all management and SharePort access from untrusted networks.
- Segment the device from important systems.
Exploitation
- A public proof-of-concept exploit is available (VulDB, GitHub repository by the researcher).
- No evidence of exploitation in the wild has been found.
- The vulnerability is not listed in the CISA KEV catalogue according to OffSeq; this was not checked directly.
Our recommendation
- Inventory the network for DIR-505 devices, including forgotten access points and routers.
- Replace affected devices with a supported model; do not rely on firmware updates.
- Until replacement, remove internet exposure and block TFTP and management interfaces.
- Monitor for a D-Link advisory or a CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry CVE-2026-120189 vuldb.com
- Public PoC repository (GitHub) github.com
- D-Link DIR-505 support page support.dlink.com
- D-Link legacy product page DIR-505 legacy.us.dlink.com
- D-Link end of service life announcement SAP10198 supportannouncement.us.dlink.com
- OffSeq Radar entry CVE-2026-120189 radar.offseq.com
- Threat intelligence entry CVE-2026-120189 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:20.
Original description (NVD)
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.