A critical, remotely exploitable stack-based buffer overflow in the TFTP service of D-Link DIR-505 firmware 1.10B02 has a public proof-of-concept exploit.
What Is It
CVE-2026-120189 is a stack-based buffer overflow (CWE-121, CWE-119) in the save_upload_file/mp_upload_file functions of /usr/bin/tftpd on the D-Link DIR-505. The flaw is in the component VulDB calls the TFTP Upload Filename Handler. The record says the overflow comes from manipulating input to this handler, and the public PoC repository's name suggests that input is the upload filename. The record says the attack can be carried out remotely.
VulDB, the CNA, published the CVE record. NVD lists it as "Received," which means NVD has not analyzed it yet.
Why It Matters
VulDB rates this CRITICAL under all three CVSS versions. The CVSS 3.1 and 2.0 scores are the maximum 10.0, and the CVSS 4.0 score is 9.3:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The vectors describe an attack over the network with low complexity. It needs no privileges and no user interaction. Confidentiality, integrity and availability impacts are all high, and the scope is changed. The NVD description says "the exploit is publicly available and might be used," and the references include a public PoC repository.
KEV status: CVE-2026-120189 is not in CISA's Known Exploited Vulnerabilities catalog. The supplied KEV data does not confirm active exploitation. A public PoC does lower the barrier to exploitation, though.
What's Vulnerable
- Vendor: D-Link
- Product: DIR-505
- Affected version: 1.10B02
- Component:
/usr/bin/tftpd(TFTP Upload Filename Handler) - CPE:
cpe:2.3:h:d-link:dir-505:*:*:*:*:*:*:*:*
The record lists no other versions as affected or unaffected.
Patch Status
The supplied records do not identify any patch, fixed firmware version or vendor advisory. The only vendor reference is D-Link's general homepage. There is no CISA KEV entry, so there is no CISA-mandated required action or due date.
Until D-Link publishes fixed firmware or guidance, owners of DIR-505 units running 1.10B02 should check D-Link's site for updates. They should also assess whether the device's TFTP service can be reached from untrusted networks.