Summary
generated automatically from NVD dataD-Link DIR-505 firmware 1.10B02 contains a stack-based buffer overflow in the save_upload_file/mp_upload_file functions of /usr/bin/tftpd, part of the TFTP Upload Filename Handler component. Manipulating the uploaded filename can trigger the overflow, and the attack can be launched remotely. The NVD description notes that a public exploit is available. The flaw is rated CRITICAL with a CVSS v3.1 score of 10.0 and is classified as CWE-119.
NVD description
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
EPSS · FIRST.org
1.3%probability of exploitation in the next 30 days
Higher than 71% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-02, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 1 nov. 2026
- Updated
- 2 nov. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-119
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.