Two separate critical security vulnerabilities have been published for D-Link’s pocket-sized DIR-505 mini router. Neither requires authentication, and working exploit code for both is publicly available on GitHub. The device has been out of manufacturer support since January 31, 2018.
The affected version is firmware 1.10B02 on the DIR-505 A1 hardware. The researcher has shown via binary comparison that the backdoor code is absent in version 1.06 of the same model.
Hidden maintenance backdoor opens unauthenticated root TFTP
The first vulnerability is CVE-2026-118579. In the firmware’s lighttpd configuration, the /secmark1524.cgi path is defined as a special shortcut to the my_cgi.cgi file. When exactly five fixed form fields are sent to this path, the CGI completely bypasses the normal session check and routine request-handling step. Then a signal is sent to the system administrator, and the device’s own TFTP server (/usr/bin/tftpd) starts running with root privileges on UDP/69 without any authentication.
The result is that an attacker on the network can read any file they want from the device: /etc/passwd, /etc/shadow, process information, and firmware binaries. If the administrator password hash is captured, offline cracking can also make it possible to log in to the interface. The vulnerability falls under the hidden function class (CWE-912); its CVSS 3.1 score is 9.8 and its CVSS 4.0 score is 8.9.
Buffer overflow in TFTP filename
The second vulnerability is CVE-2026-120189, and its score is even higher: 10.0 on CVSS 3.1 and 9.3 on CVSS 4.0. The problem is in the file upload path of the same TFTP service. The save_upload_file and mp_upload_file functions copy the incoming filename into a fixed-size stack buffer without performing a length check.
The researcher found that the 47th byte of the filename controls the return address and obtained a root shell on the device using a ROP chain they prepared. In other words, the TFTP service started without authentication by the first vulnerability becomes remote code execution through the second vulnerability. In practice, the two vulnerabilities can be used as a single attack chain: first the backdoor, then the filename overflow.
No patch, device retired in 2018
The NVD record does not specify a fixed firmware version. On D-Link’s legacy products list, the DIR-505’s end-of-support date appears as January 31, 2018; on that page, the manufacturer recommends retiring products that are no longer developed or supported.
The vulnerabilities are not on CISA’s Known Exploited Vulnerabilities list, and active attacks have not been confirmed in official sources. However, exploit code for both vulnerabilities is public; if the device sits in an internet-facing position, this significantly lowers the bar for exploitation.
What to do
If you have a DIR-505, the first option is to stop using the device as a router. Since no firmware update is coming, there is no vulnerability that can be closed with software.
If you continue using it temporarily, completely block the management interface (TCP/80) and UDP/69 from the internet, and disable remote management features. Keep the device on a trusted network, preferably on a separate VLAN; do not plug it into guest networks or shared networks such as hotels and cafes.
If the device has run on an unfamiliar network for a long time, it is worth resetting its settings and changing the administrator password. If you are thinking of buying the same model secondhand, make your decision knowing that it is hardware whose support has ended.
Source: NVD · Walnut1337 research report
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.