D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the upgrade firmware functionality.