CVE-2025-11407: D-Link DI-7001 MINI upgrade_filter.asp os command injection

Published Oct 7, 2025

Updated

A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgradefilter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Affected Software

2 affected components

All of the following

Dlink Di-7001mini-8g Firmware=24.04.18b1

Dlink Di-7001mini-8g=b1

Event History

Oct 7, 2025

CVE Published

via MITRE·08:02 PM

Data Sourced

via MITRE·08:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11407?

CVE-2025-11407 is considered a high severity vulnerability due to the potential for remote command injection.

How do I fix CVE-2025-11407?

To fix CVE-2025-11407, it is recommended to update your D-Link DI-7001 MINI firmware to the latest version provided by the vendor.

What causes CVE-2025-11407?

CVE-2025-11407 is caused by a flaw in the /upgrade_filter.asp file that allows manipulation of the path argument, leading to OS command injection.

Who is affected by CVE-2025-11407?

CVE-2025-11407 affects users of the D-Link DI-7001 MINI router running the firmware version 24.04.18B1.

Can CVE-2025-11407 be exploited remotely?

Yes, CVE-2025-11407 can be exploited remotely, allowing attackers to inject commands from an external location.