D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the tftp restore functionality.