CVE-2025-12313
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
Remote command injection can allow an attacker to gain full control of the device, potentially leading to network traffic interception or use of the device for further attacks.
Recommendation
Update the device firmware if a patch is available. Restrict remote access to the device and monitor network traffic.
Other vulnerabilities in D-Link DI-7001 MINI
See all- CVE-2025-11407Medium
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- CVE-2026-10270High
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2025-11408High
A security vulnerability has been detected in D-Link DI-7001 MINI (version 24.04.18B1). The affected element is an unknown function of the file /dbsrv.asp. Manipulation of the str argument leads to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS