CVE-2025-51457
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint.
Published Sep 25, 2026 · updated Oct 14, 2026
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · NIST NVD
Detected
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.
Oct 14, 2026 · NIST NVD
Updated
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.
Sources
- CVE.orgCVE-2025-51457
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-51457
30-day exploitation probability 1.3%
first.org - NIST NVDCVE-2025-51457
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.
nvd.nist.gov