Dir 505
Monthly
Stack-based buffer overflow in the TFTP upload filename handler of D-Link DIR-505 firmware 1.10B02 lets remote attackers send a crafted upload filename to /usr/bin/tftpd and corrupt stack memory, with high confidentiality, integrity, and availability impact under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires the TFTP upload service to be running and reachable from the attacker's network position; the target is a specific retired travel-router model and firmware. No CISA KEV entry is present, but a public PoC reference exists on GitHub and has not been verified as working exploit code; the vuln.today decision label is act_now.
Stack-based buffer overflow in the TFTP upload filename handler of D-Link DIR-505 firmware 1.10B02 lets remote attackers send a crafted upload filename to /usr/bin/tftpd and corrupt stack memory, with high confidentiality, integrity, and availability impact under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires the TFTP upload service to be running and reachable from the attacker's network position; the target is a specific retired travel-router model and firmware. No CISA KEV entry is present, but a public PoC reference exists on GitHub and has not been verified as working exploit code; the vuln.today decision label is act_now.