Overview
CVE-2026-120189 is a critical stack-based buffer overflow in the D-Link DIR-505 router, firmware 1.10B02. The flaw sits in the save_upload_file / mp_upload_file functions of /usr/bin/tftpd, in the TFTP upload filename handler. NVD describes the attack as possible to carry out remotely.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-120189 |
| Severity | Critical |
| CVSS Score | 10.0 |
| Weakness | Stack-based buffer overflow |
| Affected component | /usr/bin/tftpd — TFTP Upload Filename Handler |
| Attack vector | Remote |
| Published | 2026-11-01 |
Manipulating the upload filename processed by the TFTP service overflows a stack buffer. Stack overflows in network-facing daemons on embedded devices commonly lead to denial of service or arbitrary code execution, often with root privileges.
Impact
- A remote attacker who can reach the TFTP service may be able to crash the service or run code on the router.
- A compromised router gives access to traffic passing through it and a foothold in the local network, and may be recruited into a botnet.
- The DIR-505 is an older consumer model. Check the vendor's support status before assuming a firmware fix exists.
Remediation
- Check D-Link's security advisories for a fixed firmware for the DIR-505. If none is published, assume the device is unpatched.
- Block TFTP (UDP/69) and WAN-side management at the network edge, and do not expose the router's services to the internet.
- Replace the device if it is end-of-life or no fix is released.
- Monitor for unexpected TFTP traffic to the router and for unexplained configuration changes.