D-Link DAP-2610 CVE-2025-51457

Requires (1) network reachability to the DAP-2610 web management interface and (2) valid authenticated access to that interface (PR:L) - the description explicitly states 'an attacker with authenticated access.' Exploitation then targets injectable parameters at the /index.xgi endpoint on firmware up to 2.06B08r099. Limiting factors: the management interface should not be exposed to untrusted networks/the internet, so realistic exposure depends on whether admin credentials are default/weak or the AP UI is reachable by lower-trust users; SSVC 'Automatable: no' indicates it cannot be trivially mass-exploited. No special non-default feature toggle is required beyond having the web interface enabled.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity command injection requiring only low-privilege authentication and no user interaction, yielding total compromise of the device - consistent with the SSVC 'Technical Impact: total' rating. However, several signals temper the raw score: SSVC marks Exploitation as 'poc' (proof-of-concept, not active exploitation) and Automatable as 'no', meaning it is not amenable to mass/wormable exploitation and instead requires case-by-case targeting. No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no evidence of widespread real-world exploitation. The key gating factor is PR:L: the attacker must already hold valid credentials to the DAP-2610 web interface, so this is a post-authentication device takeover rather than a pre-auth internet worm. Net assessment: a genuinely severe flaw once an attacker has admin/user web access (e.g., default or weak credentials, or a chained auth bypass), but real-world priority is moderated by the authentication requirement, non-automatable exploitation, PoC-only status, and the niche access-point footprint. Note: affected-version data is weak - EUVD lists only 'n/a n/a' and NVD references are generic D-Link bulletin landing pages, so precise fixed-version confirmation is not available from the provided data.

An attacker who has obtained credentials to the DAP-2610 web management interface (via default/weak passwords, credential reuse, or a separate auth bypass) sends a crafted request to the /index.xgi endpoint with malicious values in the injectable parameters. The injected shell metacharacters are passed to a system call, executing arbitrary commands with device (typically root-level) privileges. SSVC indicates PoC exploit code exists, though the attack is not automatable and requires prior authentication and network reachability to the management interface.