CVE-2025-12313 is a Medium severity (CVSS 6.3) command injection in the D-Link DI-7001 MINI router, firmware 19.09.19A1 and 24.04.18B1. The cmd parameter of the page /msp_info.htm is affected. No fixed version is confirmed, so restrict management access and watch D-Link's advisories.
What's affected
The record names D-Link DI-7001 MINI firmware 19.09.19A1 and 24.04.18B1. The affected code is in the file /msp_info.htm, where the cmd argument is mishandled. The record says the attack may be launched remotely and that the exploit has been disclosed to the public.
Weakness classes: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component (injection)), CWE-77 (Command Injection).
The vector says the attacker needs a low-privilege account. No fixed version appears in the record or its references.
How to check if you're exposed
- Find DI-7001 MINI devices in your asset inventory, or by scanning your management network for the device web interface.
- Read the firmware version on the device status page and compare it with the two versions in the record.
- Check whether the web management port is reachable from the internet, a guest network or a user network.
- Review the device log for requests to /msp_info.htm from unexpected addresses.
What to do now
- Limit the management interface to an admin network and block it from the internet.
- Make sure the administrator account uses a strong, unique password.
- Check D-Link's security bulletins and support page for newer firmware, and apply it after testing if it exists.
- If the vendor has no fix, plan a replacement.
- Record the device and the exposure in your risk register while it remains in service.
Why it matters
Command injection means text supplied by a user reaches a shell command on the device. Routers sit at the edge of a network, so a bug that lets someone run commands there gives a foothold for other attacks. The medium rating reflects the privileges the vector requires, so shrinking who can sign in to the device is a real control.
Fixed firmware for small business routers can take a long time, and many sites never apply it. The record shows no sign of exploitation in the wild and the CVE is not in the CISA KEV catalog.
Quick check
Is a fixed firmware version known?
Not from the record. Check the D-Link support page for the DI-7001 MINI before assuming one exists.
Sources
- Safeguard Gold entry for CVE-2025-12313
- NVD record for CVE-2025-12313 (published 27 October 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://github.com/DavCloudz/cve/issues/7
- https://vuldb.com/?ctiid.329985
- https://vuldb.com/?id.329985
- https://vuldb.com/?submit.676887
- https://www.dlink.com/
Last reviewed: 19 October 2026.
