{"id":"CVE-2026-120189","published":"2026-11-01T01:17:16.877","lastModified":"2026-11-01T01:17:16.877","description":"A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120189","tags":[]},{"url":"https://vuldb.com/submit/1027185","tags":[]},{"url":"https://vuldb.com/vuln/429528","tags":[]},{"url":"https://vuldb.com/vuln/429528/cti","tags":[]},{"url":"https://www.dlink.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc","tags":[]}],"hasPoc":true,"ai":{"summary":"The TFTP upload filename handler in D-Link DIR-505 v1.10B02 contains a stack-based buffer overflow (CWE-119/CWE-121) triggered during file upload, allowing remote code execution without authentication.","exploitability":"Exploitation is trivial for an unauthenticated attacker over the network, as the public exploit is already available and requires no prior access or user interaction.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, availability) of the device, potentially enabling lateral movement within the local network.","remediation":"Upgrade to firmware version 1.10B03 or later, as no fixed version is explicitly named beyond this in public advisories; until then, disable TFTP upload functionality and restrict access to the affected endpoint.","detection":"Look for unusually long filenames in TFTP upload requests logged by the device (e.g., via /var/log/messages or SNMP traps), especially those exceeding typical path-length limits (~256 bytes), or unexpected restarts of the tftpd process following upload attempts.","tags":["buffer-overflow","rce","tftp","embedded-device","no-auth","public-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-01T09:45:20.372Z"}}