CVE-2007-1435

D-Link TFTP Server 1.0 - Denial of Service via Long GET or PUT Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2007-1435. PoCs published by Metasploit, LSO, including Metasploit module exploits/windows/tftp/dlink_long_filename.

AI-analyzed exploit summary This exploit targets a stack buffer overflow in D-Link TFTP 1.0 via a UDP request with an overly long filename, allowing arbitrary code execution. It includes specific return addresses for Windows 2000 SP3/SP4 and uses a bind payload for exploitation.

Description

Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16345

This exploit targets a stack buffer overflow in D-Link TFTP 1.0 via a UDP request with an overly long filename, allowing arbitrary code execution. It includes specific return addresses for Windows 2000 SP3/SP4 and uses a bind payload for exploitation.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link TFTP 1.0
No auth needed
Prerequisites: Network access to the target's TFTP service (UDP port 69) · Target running D-Link TFTP 1.0 on Windows 2000 SP3/SP4
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by LSO · rubyremotehardware
https://www.exploit-db.com/exploits/29735

This Metasploit module exploits a stack-based buffer overflow in D-Link TFTP 1.0 via a maliciously crafted UDP packet with an overly long filename. It includes a payload delivery mechanism for remote code execution on vulnerable Windows systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link TFTP 1.0
No auth needed
Prerequisites: Network access to UDP port 69 on the target · Vulnerable D-Link TFTP service running
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GOOD
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/tftp/dlink_long_filename.rb

This Metasploit module exploits a stack buffer overflow in D-Link TFTP 1.0 by sending a UDP request with an overly long filename, leading to arbitrary code execution. It includes specific return addresses for Windows 2000 SP3/SP4 targets and a structured payload delivery mechanism.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: D-Link TFTP 1.0
No auth needed
Prerequisites: Network access to UDP port 69 on the target · Target running D-Link TFTP 1.0
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/33977
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24360
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/22923

Scores

EPSS 0.4282
EPSS Percentile 98.5%

Details

Status published
Products (1)
d-link/tftp_server 1.0
Published Mar 13, 2007
Tracked Since Feb 18, 2026