Code Execution in D-Link DI-7001 MINI_5G Firmware

Executive Summary

CVE-2025-26237 is a remote code execution vulnerability in the D-Link DI-7001 MINI_5G router version 19.10.31A1. It exists in the flag parameter of the msp_info function, allowing attackers to inject and run arbitrary commands on the device.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your D-Link DI-7001 MINI_5G router is running firmware version 19.10.31A1. You can verify this by logging into the router's admin panel and checking the firmware version under system settings. Alternatively, use network scanning tools like nmap to identify the device and its firmware version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take full control of your D-Link DI-7001 MINI_5G router. They could steal data, monitor network traffic, or use the device as part of a botnet without your knowledge.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router's firmware to the latest version provided by D-Link. If no update is available, consider replacing the device with a newer model that is no longer vulnerable. Disable remote administration features if not needed and restrict access to the router's admin panel via firewall rules.

Useful 0 Not Useful 0