The vulnerability is a command injection flaw in the D‑Link DAP‑2610 web interface at the /index.xgi endpoint. An authenticated user can supply special parameters that are passed directly to the underlying operating‑system shell, allowing arbitrary command execution. This is identified as CWE‑77. Based on the description, it is inferred that an attacker could potentially gain full control of the device's operating system, enabling further compromise.

The vulnerability targets D‑Link DAP‑2610 units running firmware up to and including 2.06B08r099. Any deployed router with that firmware version, if the web interface is reachable and valid login credentials exist, is considered at risk.

Based on the description, it is inferred that exploitation requires initial authenticated access, which may be gained through default or weak passwords, credential reuse, phishing, or other means. Once logged in, the attacker can trigger the injection without additional privileges or escalation. The CVSS score of 8.8 reflects the high impact of remote command execution, while the EPSS score of 1% indicates a low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, but its web‑based nature makes it accessible to anyone able to reach the router’s interface from a local or adapted network.