CVE-2025-11407
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to full device compromise.
Recommendation
Update the device firmware to a patched version or restrict access to the administrative panel.
Other vulnerabilities in D-Link DI-7001 MINI
See all- CVE-2025-12313Medium
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-10270High
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2025-11408High
A security vulnerability has been detected in D-Link DI-7001 MINI (version 24.04.18B1). The affected element is an unknown function of the file /dbsrv.asp. Manipulation of the str argument leads to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS