D-Link DIR-505 tftpd save_upload_file stack-based buffer overflow

#!/usr/bin/env python3
"""Check for exposed TFTP (UDP/69) on D-Link DIR-505 or any TFTP server."""
import argparse
import ipaddress
import socket
import sys

def check_host(host, port=69, timeout=3):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(timeout)
        pkt = b'\x00\x01' + b'noisgate-probe' + b'\x00' + b'octet' + b'\x00'
        sock.connect((host, port))
        sock.send(pkt)
        try:
            data, _ = sock.recvfrom(1024)
            # TFTP error opcode 5 = any response, listener is present
            if len(data) >= 2 and data[1] == 5:
                return 'VULNERABLE'
            return 'VULNERABLE'
        except socket.timeout:
            return 'UNKNOWN'
        except ConnectionRefusedError:
            return 'PATCHED'
        finally:
            sock.close()
    except OSError as e:
        if e.errno == 111:
            return 'PATCHED'
        return 'UNKNOWN'

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('target', help='IP or CIDR to check')
    ap.add_argument('--port', type=int, default=69)
    ap.add_argument('--timeout', type=float, default=3.0)
    args = ap.parse_args()
    targets = []
    try:
        net = ipaddress.ip_network(args.target, strict=False)
        targets = [str(ip) for ip in net.hosts()] if net.num_addresses > 2 else [args.target]
    except ValueError:
        targets = [args.target]
    for host in targets:
        status = check_host(host, args.port, args.timeout)
        print(f'{host}: {status}')
        if status == 'VULNERABLE':
            sys.exit_code = 1
    sys.exit(0)

if __name__ == '__main__':
    main()