CVE-2025-51457CWE-77command-injection

CVE-2025-51457

High · published September 25, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
69.9
In the wild
Unconfirmed
What it is

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01287 · 69.9th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-09-25T17:17Z
References (3)
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428 · [email protected]https://www.dlink.com/en/security-bulletin/ · [email protected]https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10428 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 SEP 03:22Z
    EPSS moved — → 1%
    epss
  • 25 SEP 00:00Z
    D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint
    cvelistv5