CVE Intelligence
Analysis AI-assisted

CVE-2025-11408: D-Link DI-7001 MINI dbsrv.asp buffer overflow

A buffer overflow in the /dbsrv.asp component of D-Link DI-7001 MINI 24.04.18B1 is recorded as remotely triggerable, with an NVD CVSS 3.1 base score of 9.8. The record states that an exploit has been publicly disclosed, but the vulnerability is not listed in the CISA KEV catalog. No fixed version appears in the consulted data, so exposure should be restricted and vendor guidance checked.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a buffer overflow classified as CWE-119 in an unidentified function reached through the file /dbsrv.asp on the D-Link DI-7001 MINI, version 24.04.18B1. The information comes from the CVE record, which was assembled from NVD, the CVE Program and VulDB data. The record states that the issue may be triggered remotely.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack vector, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability.
  • The SSVC data in the record lists technical impact as total.
  • VulDB's CVSS 4.0 scores in the record range from 7.4 to 8.7, depending on the provider, so severity scoring differs between sources.

Affected products and versions

  • D-Link DI-7001 MINI, version 24.04.18B1.
  • Dlink Di-7001mini-8g Firmware, version 24.04.18b1 (spelling as listed in the record).

No other affected versions are listed in the consulted record. The absence of additional versions does not confirm that other releases are unaffected.

Exploitation status

  • The CISA KEV catalog entry in the record shows listed as false. No confirmed active exploitation appears in the sources consulted.
  • The record states that the exploit has been disclosed publicly and may be used. A reference tagged as exploit-related is included in the record.
  • The SSVC exploitation field is recorded as poc (proof of concept), and automatable is recorded as no.
  • The EPSS probability is recorded as 0.00871 with a percentile of 0.57762, dated 2026-10-13 in the record.

Remediation and mitigation

  • No fixed version is listed in the record. Check the official D-Link support channels at D-Link for firmware updates or end-of-life notices for this model.
  • Remove direct internet exposure of the device's web management interface and restrict access to trusted administrative networks.
  • Place affected devices behind segmentation or filtering controls that limit which hosts can reach them.
  • If no supported fix is available, plan isolation or replacement of the device.
  • Review the vendor and CVE references, including the NVD entry and the VulDB entry, for updates.

Detection guidance

  • Maintain an inventory that identifies D-Link DI-7001 MINI devices and their firmware versions.
  • Review web server and device logs for unusual requests to the /dbsrv.asp path, especially from unexpected sources.
  • Watch for unexpected device restarts, service failures or abnormal network behaviour from the device.
  • Apply network monitoring to detect traffic to management interfaces from outside approved networks.

Limitations of the available information

  • The record does not identify the specific function or the exact conditions required for exploitation.
  • No vendor advisory or fixed version is included in the consulted sources.
  • Scores differ between NVD, VulDB and the CNA, and the EPSS date in the record should be verified against the live data source.
  • Whether other firmware branches or hardware variants are affected is unknown.

Frequently asked questions

Is CVE-2025-11408 known to be actively exploited?

The KEV entry in the record is not listed, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Which D-Link models and versions are affected?

The record lists the D-Link DI-7001 MINI version 24.04.18B1 and a firmware entry for the Di-7001mini-8g with version 24.04.18b1. Other versions are not listed in the consulted data.

Is there a fixed version available?

No fixed version is listed in the record. Check D-Link support channels for updates or end-of-life notices for this device.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.