CVE-2025-51457 identifies an authenticated command injection vulnerability in the D-Link DAP-2610 wireless access point firmware versions up to 2.06B08r099. The vulnerability exists in the web interface at the /index.xgi endpoint, where an attacker with authenticated access can manipulate parameters to execute arbitrary system commands on the device. This flaw is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary system commands on the affected device, which can lead to full system compromise including unauthorized access, data manipulation, and denial of service. The high CVSS score reflects the critical nature of this vulnerability in terms of confidentiality, integrity, and availability impacts.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to the device's web interface to trusted users only and monitor for suspicious activity. Consider disabling the web interface if not required.