D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 25, 2026 · NIST NVD

   Detected

   D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

2. Oct 14, 2026 · NIST NVD

   Updated

   D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

Sources

• CVE.orgVulnerability recordCVE-2025-51457

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-51457

  30-day exploitation probability 1.3%

  first.org
• NIST NVDVulnerability recordCVE-2025-51457

  D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

  nvd.nist.gov

References

• Reference · supportannouncement.us.dlink.com
• Reference · dlink.com