D-Link DIR-505 CVE-2026-120189: Retire and Replace the Unsupported Router

CVE-2026-120189 is a CVSS 4.0 10.0 stack-based buffer overflow affecting D-Link DIR-505 firmware 1.10B02. D-Link lists no fixed firmware and advises retiring and replacing the unsupported router.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A generic white pocket router sits inside a cyan containment ring beneath a red warning shield.
AI-generated editorial illustration; not official D-Link artwork.

D-Link DIR-505 CVE-2026-120189: Retire and Replace the Unsupported Router[1][2]

Reporting cutoff: November 1, 2026, 3:30 a.m. EST / 08:30 UTC.

The CVE record identifies a remotely attackable stack-based buffer overflow in D-Link DIR-505 firmware 1.10B02.[1] It says a public exploit is available and might be used.[1]

RETIRE AND REPLACE[2]

The bottom line

D-Link lists the DIR-505 as end-of-life/end-of-service, shows fixed firmware as “Not Available,” and concludes “Retire & Replace Device.”[2]

Verified facts

Affected build[1]The CVE record identifies DIR-505 firmware 1.10B02 as affected.[1]
CNA score[1]The CNA record assigns CVSS 4.0 a 10.0 Critical score.[1]
Support state[2]D-Link says products at end-of-life/end-of-service no longer receive software updates or security patches.[2]

What the vulnerability affects[1]

CVE-2026-120189 concerns the TFTP upload filename handler in /usr/bin/tftpd; the record names the save_upload_file and mp_upload_file functions and says manipulated input leads to a stack-based buffer overflow.[1]

Exposure predicate: DIR-505 firmware 1.10B02 is in scope when attacker-controlled network input can reach the named TFTP upload handler.[1]

The CVE record does not state whether TFTP must be enabled separately, whether it is internet-facing by default, or whether a particular operating mode is required.[1]

“Remote” describes attack capability; it does not prove that every DIR-505 is reachable from the public internet.[1]

Why replacement is the practical fix[2]

D-Link says all DIR-505 hardware revisions are end-of-life/end-of-service and that firmware development and support have ceased.[2]

SAP10355 predates CVE-2026-120189 and discusses a different reported vulnerability; it supports only the DIR-505 lifecycle, no-fix, and retire-and-replace statements here.[1][2]

What owners and small businesses should do[1][2]

  1. Verify before acting. The IT Guys practical guidance: confirm the exact DIR-505 model and firmware 1.10B02 in your inventory or on the device label.[1]
  2. Retire and replace the device. D-Link recommends replacing end-of-life/end-of-service devices, and its DIR-505 table lists no fixed firmware.[2]
  3. Do not treat an older firmware download as a fix. D-Link’s table says fixed firmware is not available.[2]
  4. Do not run public exploit code against production or third-party devices. The public exploit reference is evidence of availability, not authorization to test systems.[1]

Exploitation status[1][3]

CVE-2026-120189 was not listed in CISA Known Exploited Vulnerabilities catalog version 2026.10.30 available at the reporting cutoff.[3] That catalog absence does not prove exploitation has or has not occurred.[3]

Sources

  1. CVE Program record for CVE-2026-120189 — VulDB CNA; published November 1, 2026.

  2. D-Link DIR-505 End-of-Life/End-of-Service Support Announcement (SAP10355) — updated September 22, 2023; used only for lifecycle and replacement guidance.

  3. CISA Known Exploited Vulnerabilities catalog — catalog version 2026.10.30, exact CVE query returned zero matches.

Reporting note: Facts and catalog status are frozen at the reporting cutoff; recheck mutable sources before any publication decision.

Browse Articles

Latest Articles