by Kastro
Paper/Archive/CVE-2026-118579

CVE-2026-118579

D-Link DIR-505 — D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.1.561 × 2011.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Affected

ProductAffectedFixed inSource
DIR-5051.10B02–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/vuln/428018refvuldb.com/vuln/428018/ctiwriteupvuldb.com/cve/CVE-2026-118579writeupvuldb.com/submit/1025351exploitgithub.com/Walnut1337/DIR-505_backdoor/tree/main/pocrefdlink.com