CVE-2025-11407 is a Medium severity (CVSS 6.3) flaw in the D-Link DI-7001 MINI router: OS command injection through the path argument of the upgrade_filter.asp page. The record names firmware 24.04.18B1 and lists no patched version, so restrict the management interface and check D-Link's support pages.
What's affected
The record lists the D-Link DI-7001 MINI at firmware 24.04.18B1. The affected page is /upgrade_filter.asp and the argument is path. The weakness types are CWE-77 (command injection) and CWE-78 (OS command injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
The record states that the exploit has been made public. It does not report attacks in the wild, and the CVE is not in CISA KEV. The record also names no fixed firmware, and the public issue report in the record is a researcher write up rather than a vendor notice. Check D-Link's security bulletins and the product support page for firmware newer than 24.04.18B1.
Two CVEs on this device were published in the same period: CVE-2025-11407 (OS command injection) and CVE-2025-11408 (buffer overflow). Treat them together when you plan.
How to check if you're exposed
Sign in to the device's web interface and read the firmware version on the status or system page. If it reads 24.04.18B1, you are on the version named in the record.
Then check where the management interface listens. Look at your firewall and the device's remote management setting to see whether the web interface answers from the internet. A router that exposes an admin page to the internet is far easier to reach than one that does not.
What to do now
- Inventory every DI-7001 MINI and note each firmware version.
- Turn off remote management from the internet. Allow the web interface only from a management network or a VPN.
- Check D-Link's security bulletins for a patched firmware, and apply it once published.
- Review the device's admin accounts and change the administrator password.
- If no fix is published, plan a replacement for any unit that faces untrusted networks.
Why it matters
Command injection happens when a program builds an operating system command from input and the input can change what the command does. The safe pattern is to avoid shell commands where an API exists, validate input against a strict allow list, and never pass raw input to a shell.
On a network device, running commands means running them on the gateway itself. The score is Medium because the record's vector requires a logged in session, but admin credentials on small office routers are often weak or shared, so do not rely on the number alone.
Quick check
Is there a patched firmware for CVE-2025-11407?
The record lists none. Check D-Link's support page and security bulletins for newer firmware and apply it when available.
Is it exploited in the wild?
The record says an exploit has been made public, but the CVE is not in CISA KEV and the record does not report attacks. Public exploit details still raise the risk for exposed devices.
Sources
- Public issue report for CVE-2025-11407
- NVD record for CVE-2025-11407 (description, CVSS vector, CWEs)
If you want to see which software in your own estate has known issues, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
