CVE-2025-51457

Description

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

CVSS Vector

References

• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428
• https://www.dlink.com/en/security-bulletin/
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428