Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120189updated 1 Nov 2026, 05:21 UTC

D-Link DIR-505 router: remote memory overflow in file upload service

Someone on the internet may be able to send a specially crafted file upload to this router and crash it or take control of it. A public exploit is reported to exist.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted uploadSent over the network to the router
  2. 2TFTP upload handlerFilename input is processed without size checks
  3. 3Stack buffer overflowOversized input overwrites memory on the stack
  4. 4Router memory corruptedDevice may crash or run attacker code
  5. ResultRouter may crash or be taken over

What happened

The TFTP upload filename handler (save_upload_file/mp_upload_file in /usr/bin/tftpd) on D-Link DIR-505 firmware 1.10B02 has a stack-based buffer overflow that can be triggered remotely.

Why it is dangerous: Attackers who can reach the router over the network may be able to corrupt its memory, which can crash it or allow code execution. Home and small-office users with this router exposed to the internet are most at risk.

Are you affected?

You are affected if you run D-Link DIR-505 firmware 1.10B02 with the TFTP upload service reachable over the network.

D-Link DIR-505, firmware 1.10B02

What to do

  1. Check whether the DIR-505 is running firmware 1.10B02 and whether its TFTP service is reachable from the internet.
  2. Block external access to the router's TFTP service at your firewall or ISP modem.
  3. Check D-Link's support site for a firmware update that fixes this issue, and install it when available.
  4. Replace the device if no fix is released and it must stay exposed.

Timeline

  1. 1 Nov 2026, 01:17 UTC
    Publicly disclosed
  2. 1 Nov 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 01:17 UTC
    Picked up by Zero Radar
  4. 1 Nov 2026, 05:21 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120189 · GHSA-2j25-rfrh-cphw
CVSS
9.3 / 10
EPSS
1.3% chance of exploitation within 30 days
Disclosed
1 Nov 2026, 01:17 UTC
On Zero Radar
1 Nov 2026, 01:17 UTC (0 min after disclosure)
Last change
1 Nov 2026, 05:21 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

D-Link DIR-505 router: remote memory overflow in file upload service · Zero Radar