CVE Intelligence
Analysis AI-assisted

CVE-2025-11407: D-Link DI-7001 MINI OS command injection via upgrade_filter.asp

CVE-2025-11407 describes an OS command injection weakness (CWE-78) in the /upgrade_filter.asp file of D-Link DI-7001 MINI 24.04.18B1, which the record says can be initiated remotely. NVD assigns a CVSS 3.1 base score of 9.8 (critical), while other providers in the record score it lower. The record states that a public exploit exists, but CISA KEV does not list this CVE and the record contains no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-11407 is an OS command injection weakness (CWE-78) affecting the /upgrade_filter.asp file of D-Link DI-7001 MINI 24.04.18B1. According to the record, the manipulated argument is path and the flaw can be initiated remotely. The record was published on 2025-10-07 and the CNA is VulDB.

Impact

  • NVD rates the issue as critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no privileges, no user interaction and high impact to confidentiality, integrity and availability.
  • Other scores in the record, including VulDB entries under CVSS 3.1, are lower, so the severity depends on the scoring source.
  • SSVC data in the record marks technical impact as partial and automatable as no.

OS command injection generally allows an attacker to run operating system commands on the device when untrusted input reaches a system shell. The actual consequences depend on how the device handles this input, which the record does not describe.

Affected products and versions

  • D-Link DI-7001 MINI, version 24.04.18B1.
  • A second entry in the record lists Dlink Di-7001mini-8g Firmware with the same version written in lowercase.

The record does not list any fixed version.

Exploitation status

CVE-2025-11407 is not listed in CISA KEV, so this analysis does not state that it is exploited in the wild. The record says the exploit has been made available to the public, and it references a GitHub issue tagged as exploit-related. SSVC exploitation is recorded as poc. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • No fixed version is recorded. Check the vendor site D-Link for firmware updates or security notices for this model.
  • Until a fix is verified, restrict access to the device web and management interfaces to trusted networks, and disable remote administration where it is not needed.
  • Place the device behind network controls that limit which hosts can reach its web interface.
  • Inventory all DI-7001 MINI units, including the firmware naming listed above, and prioritize units reachable from untrusted networks.
  • Track updates in the VulDB entry.

Detection guidance

  • Review web server and device logs for unusual requests to upgrade_filter.asp, especially requests with unexpected characters in the path parameter.
  • Monitor for unexpected outbound connections or new processes on the device where logging is available.
  • Alert on administrative interface access from unfamiliar sources.

These are high-level indicators only and do not replace vendor guidance.

Limitations of the available information

  • The record marks the affected function as unknown, so the exact behavior of upgrade_filter.asp is not described.
  • No fixed version, vendor advisory or patch status is recorded.
  • The record contains an EPSS date of 2026-10-13, which is later than the publication date and should be verified against the source.
  • Scores differ among providers and CVSS versions, and the record does not explain the differences.
  • This analysis does not include proof-of-concept details.

Frequently asked questions

Is CVE-2025-11407 known to be actively exploited?

CISA KEV does not list this CVE, so the analysis does not state active exploitation. The record says a public exploit exists and SSVC lists exploitation as poc, but no confirmed exploitation appears in the sources consulted.

What is the severity of CVE-2025-11407?

NVD assigns a CVSS 3.1 base score of 9.8 (critical). Other providers in the record score it lower, so the severity depends on the source.

Which versions are affected and is there a fix?

The record lists D-Link DI-7001 MINI version 24.04.18B1 and a firmware entry with the same version. No fixed version is recorded, so users should check the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.