CVE-2026-10270
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can cause device crash or potentially execute arbitrary code, leading to full compromise of the router.
Recommendation
Apply firmware update from the vendor or restrict access to the management interface.
Other vulnerabilities in D-Link DI-7001 MINI
See all- CVE-2025-12313Medium
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-11407Medium
A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- CVE-2025-11408High
A security vulnerability has been detected in D-Link DI-7001 MINI (version 24.04.18B1). The affected element is an unknown function of the file /dbsrv.asp. Manipulation of the str argument leads to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpd_debug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS