CVE-2025-12313

MediumCVSS 6.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

3.96%

90th percentile - higher than 90% of all known CVEs

Summary

A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Risk Assessment

Remote command injection can allow an attacker to gain full control of the device, potentially leading to network traffic interception or use of the device for further attacks.

Recommendation

Update the device firmware if a patch is available. Restrict remote access to the device and monitor network traffic.

Other vulnerabilities in D-Link DI-7001 MINI

CVE-2026-10270High
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS