On this page (7 sections)
A critical vulnerability, tracked as CVE-2026-120189, affects the D-Link DIR-505 router running firmware 1.10B02. The flaw is a stack-based buffer overflow in the TFTP upload filename handler, and the GitHub advisory says it can be attacked remotely and that a public exploit is available.
If you run a DIR-505, manage one for a client, or have one sitting in a branch office, home office or lab that also reaches your website infrastructure, this is worth checking today. The research lists no patched version, so the practical focus is reducing exposure.
What happened
The vulnerability was published on November 1, 2026 and appears in the NVD record and the GitHub Advisory Database. The GitHub entry is marked unreviewed, and the NVD text is the same description, so this is effectively one source rather than two independent confirmations.
The description says the problem sits in the functions save_upload_file and mp_upload_file in the file /usr/bin/tftpd, part of the TFTP upload filename handler. Manipulating the input leads to a stack-based buffer overflow. The advisory references a public proof of concept repository and VulDB entries. We have not reviewed that material and do not describe it here.
Technical details in plain terms
A stack-based buffer overflow happens when a program copies data into a fixed-size memory area without checking its length. Extra data spills over into adjacent memory, which can crash the service or, in the worst cases, let an attacker run their own code. Here, the data in question is the filename supplied during a TFTP upload.
TFTP is a very simple file transfer protocol with no built-in authentication. That matches the CVSS v4 metrics in the advisory: network attack vector, low attack complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability.
Who is affected
The only affected version named is DIR-505 firmware 1.10B02. The sources do not say whether other DIR-505 firmware versions or other D-Link models are affected, so do not assume they are safe or vulnerable without checking with D-Link.
Realistic exposure depends on whether the router's TFTP service can be reached by an attacker. A device reachable from the internet, or from an untrusted network segment, is at higher risk than one reachable only from a trusted LAN. Because the router sits between your network and everything else, a compromised device can affect any site, office tool or admin session behind it.
How to check your exposure
- Identify whether you have a DIR-505. The model number is printed on the device label and shown in the router admin page.
- Open the admin interface and read the firmware version. Compare it with 1.10B02.
- Check whether any port forwarding, DMZ or remote management setting exposes the router or its services to the internet.
- From a machine outside your network, scan only your own public IP for open UDP port 69 (the standard TFTP port). Only scan addresses you own or are authorized to test.
sudo nmap -sU -p 69 YOUR.PUBLIC.IP.ADDRESSA result of open or open|filtered on port 69 means TFTP may be reachable and deserves a closer look. Closed suggests the standard TFTP port is not exposed, though it does not prove the device is unaffected, since the sources do not say which port or interface the vulnerable handler uses.
What to do now
No fixed firmware is named in the available sources, so confirm the current status directly with D-Link before relying on any assumption. In the meantime, limit who can reach the device.
0 of 7 done
Detection and monitoring
Signs of attempted abuse may include unexpected router reboots, configuration changes you did not make, new DNS settings, or unfamiliar outbound connections from the device. Router logs, if enabled and sent to a separate log host, are the best place to look.
From the outside, you can keep an eye on what your public IP exposes. The Webforta SSL checker and security headers checker are free, and Webforta Monitor can alert you to certificate, DNS and uptime changes on your websites, which helps you notice if traffic is being redirected. These tools look at your sites, not at router firmware, so they do not replace patching or exposure checks on the router itself.
If you suspect a router has been compromised, our guides on checking if a website is hacked and what to do when a website is hacked cover the follow-up steps for sites behind it, such as rotating credentials.
What we do not know yet
- Whether D-Link has acknowledged the issue or released a fix.
- Whether the flaw is being exploited in the wild. The advisory only says a public exploit exists.
- Whether other firmware versions or models are affected.
- Whether the TFTP service is enabled by default or only in certain configurations.
We will treat these as unconfirmed until D-Link or another independent source says otherwise.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.