CVE-2025-51457: Command Injection
Published Sep 25, 2026
·Updated
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.
Affected Software
1 affected component
D-Link DAP-2610<=2.06B08r099
Event History
Sep 25, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker needs authenticated access to the DAP-2610 web interface. The affected attack surface is the /index.xgi endpoint, where certain parameters can be used to execute system commands.
2
Which versions are affected?
DAP-2610 firmware versions up to and including 2.06B08r099 are affected.
3
What is the impact of successful exploitation?
Successful exploitation allows an authenticated attacker to execute arbitrary system commands on the device.