EUVD-2026-33693
GHSA-m47m-chp5-wgqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed DI-7001 MINI web interface
-
DeliveryObtain low-privilege admin credentials
-
ExploitSend crafted Time parameter to /httpd_debug.asp
-
ExecutionOverflow stack buffer via sprintf
-
PersistHijack control flow in httpd
-
ImpactExecute code as root on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the device's HTTP management interface and valid low-privileged credentials (CVSS PR:L), then issue a request to the /httpd_debug.asp endpoint with a malicious Time argument; no user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Exploitation is limited to D-Link DI-7001 MINI units running firmware 19.09.19A1 or earlier with the web management interface accessible from the attacker's vantage point - deployments that restrict admin access to a management VLAN, disable the WAN-side admin UI, or have already moved off the affected firmware are not exposed. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N indicates a network-reachable, low-complexity attack that nonetheless requires some level of authentication (PR:L), with high impact on confidentiality, integrity, and availability on the vulnerable component. Exploit maturity is marked E:P (proof-of-concept) and a working PoC is published in a public GitHub repository, raising practical risk despite the auth requirement - D-Link SOHO devices commonly retain default or weak credentials, narrowing the gap between PR:L and effectively unauthenticated access. The vulnerability is not listed in CISA KEV and no EPSS score was provided in the input, so widespread mass exploitation is not yet documented; however, the combination of a public PoC, a typically root-privileged httpd, and an internet-exposed management plane warrants priority patching for any externally reachable deployment. No conflicting signals were observed between CVSS scope (SC:N/SI:N/SA:N) and the description, which both agree the impact is confined to the vulnerable device. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege credentials to the DI-7001 MINI web interface - through phishing, credential reuse, default-password scanning, or insider access - sends a crafted HTTP request to /httpd_debug.asp with an over-long Time parameter, triggering the sprintf-based stack overflow and overwriting the saved return address. Using the publicly available PoC from the 666324/dlink-DI-7001MINI-8G-vuln repository, they redirect execution to shellcode or a ROP chain to gain a root shell on the device, then pivot into the internal network behind the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows authenticated remote attackers to corrupt memory via the Time parameter passed to the sprintf function in /httpd_debug.asp. Publicly available exploit code exists on GitHub, and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privilege requirement and no user interaction. The vulnerability targets an embedded networking appliance commonly deployed at SMB and branch-office perimeters, increasing exposure risk where the management interface is reachable.
Earlier versions of this analysis (2)
Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows remote authenticated attackers to corrupt memory via the Time parameter handled by a sprintf call in /httpd_debug.asp. Publicly available exploit code exists, raising the practical risk despite no current CISA KEV listing. The flaw can lead to arbitrary code execution or device compromise affecting confidentiality, integrity, and availability.
Stack-based buffer overflow in the D-Link DI-7001 MINI router (firmware up to 19.09.19A1) allows remote authenticated attackers to corrupt memory by submitting a crafted Time argument to the /httpd_debug.asp endpoint, which is passed unsafely to sprintf. Publicly available exploit code exists (published on GitHub by researcher 666324 via VulDB), and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact with only low-privilege authentication required. No CISA KEV listing or EPSS data is referenced in the available intelligence.
RemediationAI
No vendor-released patch identified at time of analysis - the references include only the VulDB advisory (https://vuldb.com/cve/CVE-2026-10270) and the public PoC repository (https://github.com/666324/dlink-DI-7001MINI-8G-vuln), with no link to a fixed firmware build on D-Link's support site. Until a firmware update is published, restrict access to the device's web management interface to a dedicated management VLAN or trusted source IPs via ACL, and ensure the WAN-side admin interface is disabled (the trade-off is loss of remote administration). Rotate any default or weak administrative credentials immediately to make the PR:L requirement a meaningful barrier, and where possible block requests to /httpd_debug.asp at an upstream reverse proxy or filtering device (this may break legitimate diagnostic workflows). Monitor https://www.dlink.com/ and the vendor's security bulletin feed for a firmware release superseding 19.09.19A1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product (cpe:2.3:a:d-link:di-7001_mini) is a D-Link small-business gateway/router running a web-based administrative interface served by an embedded httpd. The flaw maps to CWE-121 (Stack-based Buffer Overflow) and originates in an unsafe sprintf call inside the /httpd_debug.asp handler that formats the user-supplied Time argument into a fixed-size stack buffer without bounds checking. Because embedded MIPS/ARM router firmware often ships without modern stack protections (ASLR, stack canaries, NX consistently enforced), such overflows in CGI-style handlers frequently lead to control-flow hijack and arbitrary code execution within the httpd process, which typically runs as root on D-Link devices.
Know when Di 7001 Mini gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpd_debug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
Executive ViewAI
D-Link DI-7001 MINI routers deployed at branch offices and remote sites contain a memory corruption vulnerability (CVE-2026-10270) allowing authenticated attackers to disrupt availability, extract configuration data, or trigger device failure. Organizations with these perimeter appliances face operational risk, particularly where management interfaces are internet-facing or reachable by adversaries with network access.
Restrict network-layer access to the management interface via firewall segmentation and VLAN isolation. Disable the /httpd_debug.asp endpoint if not actively used for troubleshooting. Require multi-factor authentication for any remote management access. Deploy network intrusion detection monitoring for management-plane traffic. Maintain centralized logging of all administrative sessions and failed authentication attempts. Conduct weekly audits of management interface accessibility.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB