D-Link DIR-505 CVE-2026-120189

Exploitation requires network reachability to the TFTP Upload Filename Handler of /usr/bin/tftpd on a D-Link DIR-505 running firmware 1.10B02; the attacker supplies a crafted (oversized/malformed) upload filename that is processed by save_upload_file/mp_upload_file, overflowing a stack buffer. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated. Practical LIMITS on exploitation: the TFTP upload service must be running and reachable from the attacker's network position (on travel routers this is often only LAN-side unless WAN-exposed), the target is a single specific retired model/firmware, and the published PoC is an unverified reference rather than confirmed working code. The precise byte-level trigger beyond filename manipulation is not detailed in the available sources.

Multiple signals converge on genuine priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, with high impact to confidentiality, integrity and availability - consistent with CWE-121 stack-based buffer overflow yielding remote code execution. The vuln.today Decision label is act_now, and a public PoC reference is published, raising the likelihood that working exploit code can be reproduced. However, key signals are MISSING or SOFT: there is no CISA KEV listing, so this is NOT confirmed as actively exploited, and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. The PoC is a reference only and is not verified as working exploit code, so exploitability is plausible but not demonstrated. The one tempering factor is the target itself - the D-Link DIR-505 is a retired consumer travel router, so despite the near-maximal severity, the real-world exposed population is limited; this is a high-severity flaw in a low-footprint product rather than an internet-wide emergency, but any still-deployed internet-reachable units should be treated per the act_now label.

An attacker with network reachability to the DIR-505's TFTP service submits an upload whose filename is crafted to overflow a stack buffer in save_upload_file/mp_upload_file within /usr/bin/tftpd, corrupting the stack to hijack control flow and run attacker-chosen code on the device. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is indicated. A public PoC reference exists (GitHub) but is not verified as working exploit code, so reproduction may require additional development.