Vulnerability · Published Sep 20, 2026 · Assigned by VulDB

CVE-2026-93958D-Link R95 DHMAPI ssi system os command injection

Critical 9.1

In plain English

A critical-severity OS command injection in R95 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.7%top 14.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Affected products (as reported)

Vendor	Product	Versions
D-Link	R95	BE9500_1.00.16

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-407917 | D-Link R95 DHMAPI ssi system os command injection vdb-entry, technical-description
VDB-407917 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-93958 | CVE Analysis and Report third-party-advisory
Submit #944149 | DLink R95 1.01B06 CWE-78 third-party-advisory
https://github.com/FoundTL/D-Link-R95-BE9500 exploit
https://www.dlink.com/ product