CVE-2026-120189 D-Link CVE debrief

Who should care

Defenders responsible for D-Link DIR-505 devices, network administrators, and security teams should assess exposure and prioritize verification and remediation efforts. They should verify remote attack surface to prevent exploitation, assess exposure of D-Link DIR-505 devices to prioritize remediation, monitor for potential exploitation attempts to detect possible attacks, and review and update device configurations to prevent unauthorized access.

Why it matters

Defenders should prioritize verifying exposure of D-Link DIR-505 devices and assessing the remote attack surface due to a publicly available exploit for a critical stack-based buffer overflow vulnerability.

• Verify remote attack surface to prevent exploitation
• Assess exposure of D-Link DIR-505 devices to prioritize remediation
• Monitor for potential exploitation attempts to detect possible attacks
• Review and update device configurations to prevent unauthorized access

Technical summary

The vulnerability is caused by a stack-based buffer overflow in the save_upload_file/mp_upload_file function of the /usr/bin/tftpd file in the TFTP Upload Filename Handler component of D-Link DIR-505 1.10B02. The attack can be carried out remotely, and a public exploit is available. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. Defenders should prioritize verifying exposure of D-Link DIR-505 devices and assessing the remote attack surface to prevent exploitation and detect possible attacks.

Defensive priority

Defenders should prioritize verifying exposure of D-Link DIR-505 devices and assessing the remote attack surface.

Recommended defensive actions

• Verify exposure of D-Link DIR-505 devices
• Assess the remote attack surface
• Review and update device configurations
• Monitor for potential exploitation attempts
• Apply vendor patches or updates
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.3 and severity of CRITICAL. However, the vendor and product names are not confirmed, and the affected versions require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.