D-Link DIR-505 CVE-2026-118579

Exploitation requires network reachability to the device's Web Management CGI endpoint /secmark1524.cgi on a D-Link DIR-505 running firmware 1.10B02, and the attacker must supply the backdoor-triggering accu/pass/code/hash/cmds arguments to the vulnerable main function. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N) no authentication, no user interaction, and no special attack requirements are needed, so default-exposed devices are at risk; the real limiting factors are that the web interface must be reachable from the attacker's position (devices behind NAT with no WAN-side management exposure are far less accessible) and that the affected product is a specific, discontinued firmware version with a shrinking deployment base. The exact byte-level trigger is only partially described - the sources name the parameters but do not detail the precise values required.

This is a genuine high-priority issue for anyone still running the affected device, tempered by the fact that the product is a discontinued consumer router. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity access with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), and CWE-912 (hidden/backdoor functionality) combined with the description's reference to manipulating accu/pass/code/hash/cmds points to attacker control over device function rather than a mere disclosure. Exploit maturity in the vector is E:P (proof-of-concept), consistent with the input stating a public PoC reference exists that is not verified as working exploit code; it is NOT confirmed actively exploited - there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation cannot be asserted. The vuln.today decision label is 'this_week', indicating prompt remediation rather than emergency. Net: the raw severity (8.9) is justified by the metrics, but real-world risk is bounded by the limited and aging deployment base; treat as a priority for affected fleets while recognizing the exploitation signal is PoC-level, not confirmed in-the-wild.

A remote attacker reachable over the network sends a crafted request to /secmark1524.cgi on an exposed D-Link DIR-505, supplying the accu/pass/code/hash/cmds parameters to trigger the device's hidden backdoor functionality and gain unauthorized control. A public PoC reference exists but is not verified as working exploit code, so the practical barrier depends on whether that reference reproduces the trigger. Per the CVSS vector this requires no authentication, no user interaction, and low attack complexity.