CVE-2026-10270: D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow

Synopsis

A stack-based buffer overflow exists in the D-Link DI-7001 MINI router firmware up to version 19.09.19A1. The flaw is in the sprintf call inside the httpd_debug.asp API handler, where an attacker can supply an oversized value for the Time argument to overflow a fixed-size stack buffer. A remote attacker with a low-privilege account can exploit this to execute arbitrary code on the device, read stored credentials, or disrupt the service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoint is exposed over the network, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account on the device is sufficient to send the malicious request.

• Victim interactionNot required

  No user interaction is needed; the attacker sends the crafted request directly to the API without involving another user.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker achieves remote code execution on the router by overwriting the stack return address, gaining full control of the device process.
• Confidential data stored or passing through the device - including credentials, session tokens, and routing configuration - is readable by the attacker (VC:H).
• The attacker can modify persisted configuration, routing tables, or firmware state on the device (VI:H).
• The affected httpd service can be crashed or rendered unresponsive, cutting off management access and potentially disrupting network traffic flowing through the router (VA:H).