CVE-2025-26237: n/a

CVE-2025-26237 is a high-severity remote code execution vulnerability affecting D-Link DI-7001 MINI_5G firmware version 19.10.31A1. The vulnerability exists in the handling of the flag parameter within the msp_info functionality, which can be exploited by an unauthenticated attacker to run arbitrary commands on the device. The flaw is categorized as CWE-77, indicating improper neutralization of special elements in OS commands. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack can be performed remotely over the network with low complexity and no privileges or user interaction required, resulting in high confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary commands on the affected device, compromising confidentiality and integrity of the system. This could lead to unauthorized control or manipulation of the device's functions. There is no indication of availability impact. No known active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor communications for updates and apply any future patches promptly. Until a fix is released, restricting network access to the device and limiting exposure to untrusted networks may reduce risk.