Vulnerability · Published Oct 27, 2025 · Assigned by VulDB
CVE-2025-12313D-Link DI-7001 MINI msp_info.htm command injection
Medium 6.3
In plain English
A medium-severity command injection in DI-7001 MINI from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)4.0%top 9.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| D-Link | DI-7001 MINI | 19.09.19A124.04.18B1 |
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-329985 | D-Link DI-7001 MINI msp_info.htm command injection vdb-entry, technical-description
- VDB-329985 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #676887 | D-Link Gateway V19.09.19A1 and V24.04.18B1 Arbitrary Command Execution or Command Injection third-party-advisory
- https://github.com/DavCloudz/cve/issues/7 exploit, issue-tracking
- https://www.dlink.com/ product