CVE-2025-11408
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A security vulnerability has been detected in D-Link DI-7001 MINI (version 24.04.18B1). The affected element is an unknown function of the file /dbsrv.asp. Manipulation of the str argument leads to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The vulnerability could allow a remote attacker to execute code or cause a denial of service, potentially leading to device takeover and network compromise.
Recommendation
Check for firmware updates from D-Link and apply the patch. Restricting administrative panel access to trusted IPs is recommended.
Other vulnerabilities in D-Link DI-7001 MINI
See all- CVE-2025-12313Medium
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-11407Medium
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- CVE-2026-10270High
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in D-Link DI-7001 MINI 24.04.18B1. The affected element is an unknown function of the file /dbsrv.asp. Such manipulation of the argument str leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS