# CVE-2026-120189: D-Link DIR-505 stack-based buffer overflow in TFTP upload handler

Source: https://junglewise.ai/threats/cve-2026-120189-a-vulnerability-was-identified-in-d-link-dir-505-1-10b02  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120189 · Severity: critical · CVSS 10 · Published 2026-11-01

The D-Link DIR-505 router's TFTP upload filename handler contains a stack-based buffer overflow vulnerability that allows remote attackers to crash the device or execute arbitrary code. An attacker can exploit this flaw by sending a specially crafted filename during a TFTP upload, potentially gaining complete control over the router without authentication. Exploit code is publicly available and the vulnerability has a critical severity rating.

Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-120189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120189 being exploited in the wild.

**How severe is CVE-2026-120189?** Critical severity, with a CVSS score of 10, published 1 November 2026.

**Which products and versions are affected?** D-Link DIR-505 1.10B02.

**Is there a fix for CVE-2026-120189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120189 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120189?** Check whether you run D-Link DIR-505 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the save_upload_file/mp_upload_file function of /usr/bin/tftpd in the TFTP Upload Filename Handler component. The vulnerability is triggered by manipulation of the filename parameter during a TFTP file upload operation and is exploitable remotely without authentication. Attackers can leverage this to achieve remote code execution and potentially full system compromise.

## Affected products

- D-Link DIR-505 1.10B02

## Timeline

- 2026-11-01: disclosed
- other: Exploit code publicly available

## References

- [https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc](https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc)
- [https://vuldb.com/cve/CVE-2026-120189](https://vuldb.com/cve/CVE-2026-120189)

## Related threats

- [D-Link DIR-505 authentication bypass in web management](https://junglewise.ai/threats/cve-2026-118579-a-weakness-has-been-identified-in-d-link-dir-505-1-10b02-the)