← Back to search

CVE-2025-51457

8.8 HIGH

Published 2026-09-25 · Updated 2026-09-25

AI risk analysis

Summary
The flaw allows an authenticated attacker to inject arbitrary commands via the /index.xgi endpoint, leading to potential remote code execution.
Exploitability
Exploitation requires authenticated access and specific parameter manipulation, making it moderately difficult.
Blast radius
If exploited, the vulnerability could lead to full control over the device, including data exfiltration and denial of service.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to D-Link DAP-2610 version 2.06B08r099 or later.
rceauth-bypasswebcommand-injection

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.