CVE-2026-10270: D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow
A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1. Impacted is the function sprintf of the file /httpddebug.asp of the component API. The manipulation of the argument Time results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove the httpd_debug.asp debug endpoint (or otherwise disable the API functionality that accepts the Time argument) to prevent remote exploitation of the sprintf stack-based overflow.
D-Link DI-7001 MINI API (httpd_debug.asp) httpd_debug.asp endpoint = disabled - Compensating control
Restrict network access to the device management HTTP interface: block incoming access from untrusted networks, allow only trusted management IPs via firewall/ACLs, or isolate the device from external networks until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10270?
The severity of CVE-2026-10270 is classified as high with a score of 7.4.
How do I fix CVE-2026-10270?
To mitigate CVE-2026-10270, update the D-Link DI-7001 MINI firmware to the latest version beyond 19.09.19A1.
What type of vulnerability is CVE-2026-10270?
CVE-2026-10270 is a stack-based buffer overflow vulnerability found in the D-Link DI-7001 MINI's API.
Can CVE-2026-10270 be exploited remotely?
Yes, CVE-2026-10270 can be exploited remotely due to inadequate input validation.
What component is affected by CVE-2026-10270?
CVE-2026-10270 affects the sprintf function in the /httpd_debug.asp component of the D-Link DI-7001 MINI.