You need to use a limiting quantifier {min,max}.
If you allow empty input, use {0,10} to match 0 to 10 digits:
ValidationExpression="^[0-9]{0,10}$"
Else, use {1,10} to allow 1 to 10 digits:
ValidationExpression="^[0-9]{1,10}$"
Or to match exactly 10-digit strings omit the min, part:
ValidationExpression="^[0-9]{10}$"
Also, note that server-side validation uses .NET regex syntax, and \d matches more than digits from 0 to 9 in this regex flavor, thus prefer [0-9]. See \d is less efficient than [0-9].
Besides, it seems you can omit ^ and $ altogether (see MSDN Regular Expressions in ASP.NET article):
You do not need to specify beginning of string and end of string matching characters (^ and $)—they are assumed. If you add them, it won't hurt (or change) anything—it's simply unnecessary.
Most people prefer to keep them explicit inside the pattern for clarity.