CRITICAL

CVE-2026-93958

2026-09-20 CVSS v3.1

CVSS

9.1

Description

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Weakness (CWE)

CWE-77 Command Injection

CWE-78 OS Command Injection

References

https://github.com/FoundTL/D-Link-R95-BE9500 https://vuldb.com/cve/CVE-2026-93958 https://vuldb.com/submit/944149 https://vuldb.com/vuln/407917 https://vuldb.com/vuln/407917/cti https://www.dlink.com/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE