CVE-2026-118579 is a critical (CVSS 3.1: 9.8) flaw in D-Link DIR-505 firmware 1.10B02: a backdoor in the Web Management CGI that can be reached remotely, and a public exploit is available.
What Is It
The flaw is in the main function of /secmark1524.cgi, which is part of the device's Web Management CGI component. According to the CVE description, manipulating the arguments accu, pass, code, hash, and cmds triggers a backdoor. The weakness is classified as CWE-912 (Hidden Functionality). VulDB, the CNA, published the record on 2026-10-28. NVD's status for it is still "Received."
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- An attacker can exploit it over the network.
- Attack complexity is low.
- No privileges are required.
- No user interaction is needed.
- Confidentiality, integrity, and availability impact are all high.
The CVSS 4.0 score is 8.9 (HIGH), with exploit maturity marked as Proof-of-Concept. The CVSS 2.0 score is 10.0.
The description says the exploit is public and could be used in attacks, and a PoC repository is listed in the references. However, this CVE is not in the CISA Known Exploited Vulnerabilities catalog at the time of writing. That means CISA has not confirmed that it is being actively exploited.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-505
- Affected version: 1.10B02
- Component: Web Management CGI (
/secmark1524.cgi) - CPE:
cpe:2.3:h:d-link:dir-505:*:*:*:*:*:*:*:*
The supplied record does not list any other affected firmware versions.
Patch Status
The supplied NVD record does not mention a vendor patch, fixed firmware version, or advisory. Its only D-Link reference is the vendor's homepage. There is no KEV entry, so CISA has not set a required action or due date.
If you run a DIR-505 on firmware 1.10B02, assume it is exposed. Keep checking D-Link's official channels for guidance. Until a fix is confirmed, limit network access to the device's web management interface.