CVE-2026-120189

Summary

The TFTP upload filename handler in D-Link DIR-505 v1.10B02 contains a stack-based buffer overflow (CWE-119/CWE-121) triggered during file upload, allowing remote code execution without authentication.

Exploitability

Exploitation is trivial for an unauthenticated attacker over the network, as the public exploit is already available and requires no prior access or user interaction.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) of the device, potentially enabling lateral movement within the local network.

Detection

Look for unusually long filenames in TFTP upload requests logged by the device (e.g., via /var/log/messages or SNMP traps), especially those exceeding typical path-length limits (~256 bytes), or unexpected restarts of the tftpd process following upload attempts.

Prioritized remediation

Upgrade to firmware version 1.10B03 or later, as no fixed version is explicitly named beyond this in public advisories; until then, disable TFTP upload functionality and restrict access to the affected endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.