D-Link DIR-505, CVE-2026-120189: a new CVE scored 10

The bottom line

Check whether you run D-Link DIR-505. If you do, read the vendor's page for the fixed version and update. Nothing public says yet that anyone is using this flaw.

Free analysis report · 8 pagesD-Link DIR-505, CVE-2026-120189: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says a flaw in the TFTP upload filename handler of the router's tftpd program causes a stack-based buffer overflow. It can be triggered remotely. The record does not say what an attacker gains, only the overflow.

What the vendor's advisory says

We read one page on github.com. In short:

• The only source we hold is a code repository directory listing with three file names. It is not a vendor advisory.
• No source names a fixed version, a workaround or a vendor statement.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It is not on the CISA list, so nobody is attacking it." The record was new when read. Absence from the list means CISA has not recorded exploitation, not that nobody is trying. The record says the exploit is public.
• "There must be a patch to install." No source we hold names a fixed version. Do not assume one exists until the vendor says so in writing.

How we would triage it

This is our judgement.

Step 1: Find the DIR-505 units and their firmware

• List every DIR-505 you own, including remote and home-office units.
• Read the firmware version in the router's admin page. The record names 1.10B02 as affected.

Step 2: Reduce exposure

• Make sure the router's TFTP service and its administration pages are not reachable from the internet.
• The record says the attack can be carried out remotely, so exposure is the main factor.

Step 3: Ask the vendor about a fix

• No source names a fixed version. Ask D-Link or your provider whether one exists, and get the answer in writing.
• If none exists, plan to replace the unit.

Step 4: Confirm the result

• Record which units were found, their versions and what was changed.
• Ask your provider to confirm in writing that no affected unit is reachable from outside.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we are checking our exposure to CVE-2026-120189, a stack-based buffer overflow in the TFTP upload filename handler of the D-Link DIR-505, firmware 1.10B02. The record says it can be attacked remotely and that the exploit is public. Please tell us whether we run any DIR-505, where, and on which firmware. Please also confirm whether any can be reached from the internet, and whether D-Link has published a fix. Could you give us written confirmation of the versions and the action taken by the end of this week?

The weakness behind it

The record classes this as CWE-121 and CWE-119.

The sources, in their words

The CVE record:

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Versions of D-Link DIR-505 the record lists as affected:

• 1.10B02

What we do not know yet

• Which firmware versions other than 1.10B02 are affected is not stated.
• No source names a fixed version or a workaround.
• The record does not say what an attacker gains beyond the overflow.
• Whether D-Link still supports this model is not stated.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 1 November 2026. We read the vendor pages listed under Sources; nothing here has been tested.
• The sections headed "Does this apply to you?", "What it is", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.