Critical TFTP Flaw Hits D-Link DIR-505 Firmware 1.10B02

A critical stack-based buffer overflow, tracked as CVE-2026-120189, affects the D-Link DIR-505 running firmware version 1.10B02, according to the National Vulnerability Database.

The bug is in the TFTP upload handler. NVD says the flaw sits in the save_upload_file and mp_upload_file functions of /usr/bin/tftpd, in the TFTP Upload Filename Handler component. Manipulating it causes a stack-based buffer overflow, and the attack can be carried out remotely.

Exploit code is public. NVD notes the exploit has been publicly disclosed and may be used, and links a proof of concept on GitHub.

VulDB rates it at the maximum score. VulDB, the CVE numbering authority, scores it 10.0 under CVSS 3.1 (network attack, no privileges, no user interaction) and 9.3 under CVSS 4.0. NVD has not published its own assessment and lists the entry as Deferred. NVD lists no vendor advisory or patch. DIR-505 owners should check D-Link's support site and limit network access to the device's TFTP service.