CVE-2025-12296 is a Medium severity (CVSS 4.7) OS command injection in the firmware update handler of the D-Link DAP-2695 access point, firmware 2.00RC13. The record says the product is no longer supported, so no fix should be expected. Plan to replace the device.
What's affected
The record names D-Link DAP-2695 firmware 2.00RC13 and says the flaw is in the function sub_4174B0 of the Firmware Update Handler. It states the attack may be started remotely, that the exploit has been disclosed publicly, and that the vulnerability only affects products that are no longer supported by the maintainer.
Weakness classes: CWE-77 (Command Injection), CWE-78 (OS Command Injection).
The vector says the attacker needs a high-privilege (administrator-level) account, which is why the score is medium. Because the product is out of support, there is no fixed version to name. Check D-Link's support pages for the model if you want to confirm its status.
How to check if you're exposed
- List every DAP-2695 on your network from your asset inventory or a network scan of your management VLAN.
- Open each device's management page and read the firmware version. The record covers 2.00RC13.
- Note who can reach the management interface. Access from a guest or user network raises the risk; a locked-down management network lowers it.
- Check whether the web interface is reachable from the internet, which it should not be.
What to do now
- Restrict the management interface to a dedicated admin network and block it from the internet.
- Use a strong, unique administrator password and remove any shared credentials.
- Avoid firmware upload actions through the web interface until the device is replaced.
- Schedule replacement with a supported access point model.
- Keep a record of the unsupported device in your risk register until it is gone.
Why it matters
OS command injection means input from a user ends up in a command that the device runs. Network gear often runs its management software with full rights, so a bug in a handler such as firmware update can matter more than the score suggests. The medium rating here reflects the privileges the attacker needs, not how bad the device would be if those were available.
Unsupported hardware is the lasting problem. Vendors stop publishing patches, yet the device still sits on the network. The record gives no sign of exploitation in the wild and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Will D-Link ship a fix for the DAP-2695?
The record says the product is no longer supported by the maintainer, so a fix should not be expected. Check the vendor support page for the model to confirm.
Sources
- Safeguard Gold entry for CVE-2025-12296
- NVD record for CVE-2025-12296 (published 27 October 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Injection.md
- https://vuldb.com/?ctiid.329964
- https://vuldb.com/?id.329964
- https://vuldb.com/?submit.675855
- https://www.dlink.com/
Last reviewed: 19 October 2026.
