Roteador D-Link DIR-505 A1 · Public exploit code

PoC published for unauthenticated root RCE on D-Link DIR-505

Nov 04, 2026 · 1 min read

A researcher published a proof of concept for unauthenticated remote code execution as root on the D-Link DIR-505 A1 router running firmware 1.10B02. The flaw is a buffer overflow in the TFTP upload filename, rated CVSS 9.8, verified end-to-end against emulated real firmware. The disclosure mentions no vendor patch, though the repository includes remediation guidance; remove the device from the internet.

By HIFY Radar newsroom Updated 11/04/2026 07:59 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher published code that runs commands as root, with no password, on the D-Link DIR-505 A1 router running firmware 1.10B02. The flaw lies in the device's TFTP file transfer service. The disclosure mentions no D-Link fix.

Why it matters

Any company with this router reachable by attackers can have the device taken over without a password. A compromised router exposes network traffic and serves as a base for further attacks.

What to do

Find DIR-505 A1 routers running firmware 1.10B02, remove the TFTP service from internet exposure, and plan to replace the hardware since no fix has been announced. Follow the mitigation guidance in the published repository.

For the technical team

Affected: Roteador D-Link DIR-505 A1 · D-Link DIR-505 A1 running firmware 1.10B02, per the disclosure.
Exploitation: Public proof of concept with the full exploit chain, ROP layout analysis, a TFTP client, and proof of root-shell execution. The disclosure states end-to-end verification against emulated real firmware. No real-world exploitation reported.
Fix: The disclosure mentions no patch; the repository includes remediation guidance.
Vector: Router TFTP service: an attacker-controlled filename is copied into fixed-size stack buffers during upload, allowing return address control and a ROP chain that calls system. No authentication; requires access to the TFTP service.
More details: CVSS 9.8 (Critical) stated in the disclosure. Reported by @DarkWebInformer; the researcher's repository holds the complete exploit.