CVE-2026-118579

Summary

The D-Link DIR-505 router's web management CGI (/secmark1524.cgi) contains a backdoor triggered by manipulation of arguments (accu/pass/code/hash/cmds), enabling remote code execution without authentication.

Exploitability

Exploitation is trivial as the vulnerability allows unauthenticated remote access and a public exploit exists.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability of the device, potentially enabling complete network takeover for attackers.

Detection

Look for HTTP POST requests to /secmark1524.cgi containing unexpected or malformed parameters (accu, pass, code, hash, cmds), especially from external IP addresses or non-admin users; unauthenticated access attempts to this endpoint are abnormal and highly suspicious.

Prioritized remediation

No fixed version is published by D-Link; disable the affected endpoint (/secmark1524.cgi) and restrict access to the web management interface via ACLs or network segmentation until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.