CVE-2025-11665 is a medium severity OS command injection flaw (CVSS 4.7) in the D-Link DAP-2695 access point on firmware 2.00RC131. The firmware update handler passes input to a system command. The device is no longer supported, so the record offers no patch and you should retire or isolate it.
What's affected
The record lists the D-Link DAP-2695 on firmware version 2.00RC131. The flaw is in the fwupdater_main function of the rgbin file, part of the Firmware Update Handler component. It is classed under CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. That is a network attack of low complexity that needs a low privilege account and no user interaction. The NVD record states that the vulnerability only affects products that are no longer supported by the maintainer.
Because the product is out of support, expect no fixed firmware. The record does not name one, so check the D-Link support pages for the model to confirm the status for your hardware revision.
How to check if you're exposed
Start with an inventory of wireless access points. Look for the DAP-2695 by model number on the device label and in your network management tool. Then read the firmware version on the management page. The record names 2.00RC131.
If you manage devices from a controller or a spreadsheet, filter by model:
grep -i "dap-2695" inventory.csv
Then check who can reach the management interface. The attack needs a login, so the devices that matter most are those with shared or default administrator passwords, and those whose web interface is open to a broad internal network or the internet.
Look at your logs for firmware update actions that you did not schedule, and for administrator logins from unexpected addresses.
What to do now
-
List every DAP-2695 in the estate and its firmware version.
-
Replace out of support units on a schedule, and prioritise any that face guests or the internet.
-
Until replaced, move the management interface to a separate management network, and block it from user and guest segments.
-
Change the administrator password to a unique strong one, and disable remote management over the wide area network.
-
Restrict who can start firmware updates, and log administrator actions to a central place.
-
Check the D-Link site for any security bulletin on this model, and record the end of life date in your asset register.
Why it matters
OS command injection, tracked as CWE-77 (Command Injection) and CWE-78 (OS Command Injection), happens when software builds a command line from input and hands it to the operating system shell. Whatever the attacker can place in the input may run with the rights of the process. On an access point that process is usually privileged.
The bigger story is the lifecycle. A device that gets no updates carries every flaw forever, and the cost of that grows each year. The score of 4.7 is moderate because a login is required, but a shared admin password, or a second flaw that skips the login, changes the picture.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog.
To see whether a vulnerable package is hiding in your own projects, run the free in-browser dependency scan at gold.safeguard.sh/scan. The Gold directory lists the same advisories alongside affected versions, and reachability analysis helps you rank which findings are actually called by your code.
Quick check
Is there a firmware fix?
The record names none and says the product is no longer supported. Check the D-Link support page for your exact model and hardware revision, and plan a replacement.
If a login is required, is the risk low?
Lower, not low. Shared or default admin passwords, or a second weakness that bypasses the login, make the flaw reachable. Isolating the management interface is the key control.
Sources
Last reviewed: 19 October 2026.
