CVE-2026-118579
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
D-Link DIR-505Network & edge
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 28 Oct 2026, 23:00 UTCPublishedCVE List
- 28 Oct 2026, 23:20 UTCFirst reportTelegram: CVE Notify
- 29 Oct 2026, 00:00 UTCExploit code publicBluesky: CVE posts
Reports 5
2 outlets mention it. Reports are not confirmation; each links to its source.
- @cve.skyfleet.blue: CVE-2026-118579 - D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor CVE ID : CVE-2026-118579 Published : Oct. 28, 2026, 11:17 p.m. | 1 hour, 7 minutes ago DescriptionBluesky: CVE posts, 29 Oct 2026
- @offseq.bsky.social: D-Link DIR-505 v1.10B02 hit by CRITICAL backdoor (CVE-2026-118579, CVSS 9.3). Public exploit available. Restrict management access and monitor for compromise. Details: https://radaBluesky: CVE posts, 29 Oct 2026Exploit code
- @thehackerwire.bsky.social: 🔴 CVE-2026-118579 - Critical (9.8) A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function ma... https://www.thehackerwire.com/vulnerability/Bluesky: CVE posts, 28 Oct 2026
- @aiuto-ch.bsky.social: CVE Radar | CVE-2026-118579 | CVSS 10.0 CVE-2026-118579: DIR-505 Web CGI Backdoor CVE-2026-118579 affects D-Link DIR-505 version 1.10B02, according to the supplied NVD description.Bluesky: CVE posts, 28 Oct 2026
- 🚨 CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulatioTelegram: CVE Notify, 28 Oct 2026
Description
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Text from CVE List
Affected versions 1
- DIR-505affected: 1.10B02CVE List