CVE-2025-26237

Deferred Deferred - Pending Action

Code Execution in D-Link DI-7001 MINI_5G Firmware

Publication date: 2026-08-24

Last updated on: 2026-08-28

Assigner: MITRE

Description

D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-28

Generated

2026-09-14

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-12

NVD

CVE-2025-26237

EUVD

EUVD-2025-210768

Affected Vendors & Products

Vendor	Product	Version / Range
d-link	di-7001_mini_5g	19.10.31a1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2025-26237 is a remote code execution vulnerability in the D-Link DI-7001 MINI_5G router version 19.10.31A1. It exists in the flag parameter of the msp_info function, allowing attackers to inject and run arbitrary commands on the device.

Detection Guidance

To detect this vulnerability, check if your D-Link DI-7001 MINI_5G router is running firmware version 19.10.31A1. You can verify this by logging into the router's admin panel and checking the firmware version under system settings. Alternatively, use network scanning tools like nmap to identify the device and its firmware version.

Impact Analysis

This vulnerability allows attackers to take full control of your D-Link DI-7001 MINI_5G router. They could steal data, monitor network traffic, or use the device as part of a botnet without your knowledge.

Compliance Impact

This vulnerability allows arbitrary command execution on the D-Link DI-7001 MINI_5G router, which could lead to unauthorized access to sensitive data. Such access may violate data protection requirements under GDPR or HIPAA if the device processes personal or health information. Unauthorized control of network infrastructure could also result in non-compliance with security standards.

Mitigation Strategies

Immediately update the router's firmware to the latest version provided by D-Link. If no update is available, consider replacing the device with a newer model that is no longer vulnerable. Disable remote administration features if not needed and restrict access to the router's admin panel via firewall rules.

Hi! I’m here to help you understand CVE-2025-26237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70