Which versions of D-Link DI-7001 MINI are affected by CVE-2026-10270?

D-Link DI-7001 MINI routers deployed at branch offices and remote sites contain a memory corruption vulnerability (CVE-2026-10270) allowing authenticated attackers to disrupt availability, extract…

Is there a public PoC exploit available for CVE-2026-10270?

Yes, a public proof-of-concept exploit is available for CVE-2026-10270. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10270?

Within 24 hours: Inventory all D-Link DI-7001 MINI routers and assess whether the management interface on firmware ≤19.09.19A1 is accessible from untrusted networks or the internet. Within 7 days: Implement firewall rules and network segmentation to restrict management access to authorized administrator VPNs or bastion hosts only; enforce strong authentication on all management accounts. Within 30 days: Contact D-Link for patch availability; if no patch is released by 2026-07-01, prioritize hardware refresh or replacement of affected devices with patched alternatives.

D-Link DI-7001 MINI CVE-2026-10270

Q: What is the CVSS score of CVE-2026-10270?

CVE-2026-10270 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33693 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-01 VulDB

GHSA-m47m-chp5-wgqj

Buffer Overflow D-Link Stack Overflow Di 7001 Mini D-Link

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 01, 2026 - 17:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 01, 2026 - 17:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 01, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 01, 2026 - 17:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 01, 2026 - 17:16 vuln.today

DescriptionCVE.org

A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpd_debug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

Stack-based buffer overflow in D-Link DI-7001 MINI routers (firmware up to 19.09.19A1) allows authenticated remote attackers to corrupt memory via the Time parameter passed to the sprintf function in /httpd_debug.asp. Publicly available exploit code exists on GitHub, and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privilege requirement and no user interaction. The vulnerability targets an embedded networking appliance commonly deployed at SMB and branch-office perimeters, increasing exposure risk where the management interface is reachable.

Technical ContextAI

The affected product (cpe:2.3:a:d-link:di-7001_mini) is a D-Link small-business gateway/router running a web-based administrative interface served by an embedded httpd. The flaw maps to CWE-121 (Stack-based Buffer Overflow) and originates in an unsafe sprintf call inside the /httpd_debug.asp handler that formats the user-supplied Time argument into a fixed-size stack buffer without bounds checking. Because embedded MIPS/ARM router firmware often ships without modern stack protections (ASLR, stack canaries, NX consistently enforced), such overflows in CGI-style handlers frequently lead to control-flow hijack and arbitrary code execution within the httpd process, which typically runs as root on D-Link devices.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the VulDB advisory (https://vuldb.com/cve/CVE-2026-10270) and the public PoC repository (https://github.com/666324/dlink-DI-7001MINI-8G-vuln), with no link to a fixed firmware build on D-Link's support site. Until a firmware update is published, restrict access to the device's web management interface to a dedicated management VLAN or trusted source IPs via ACL, and ensure the WAN-side admin interface is disabled (the trade-off is loss of remote administration). Rotate any default or weak administrative credentials immediately to make the PR:L requirement a meaningful barrier, and where possible block requests to /httpd_debug.asp at an upstream reverse proxy or filtering device (this may break legitimate diagnostic workflows). Monitor https://www.dlink.com/ and the vendor's security bulletin feed for a firmware release superseding 19.09.19A1.