A publicly disclosed OS command injection flaw in the DHMAPI component of the D-Link R95 router lets a remote, high-privileged attacker execute arbitrary commands through the NTPServer parameter.
What Is It
CVE-2026-93958 is an OS command injection vulnerability (CWE-77, CWE-78) in D-Link R95 firmware BE9500_1.00.16. The flaw sits in the system function of the file /bin/ssi, part of the DHMAPI component. Manipulating the NTPServer argument allows attacker-supplied input to reach a shell command, and the attack can be carried out remotely over the network.
NVD's primary CVSS v3.1 score is 9.1 (CRITICAL): AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The CNA (VulDB) also supplies a CVSS v4.0 score of 8.5 (HIGH) with an exploit maturity of Proof-of-Concept, and a CVSS v2.0 score of 8.3.
Why It Matters
The exploit has been made public, which lowers the barrier to opportunistic use. The CVSS v3.1 vector rates the scope as changed, with complete loss of confidentiality, integrity, and availability; consistent with command execution in the router's underlying OS, where an attacker gains a foothold on the network boundary itself.
The mitigating factor is that exploitation requires high privileges (PR:H; CVSS v2 lists multiple authentication instances). Attack complexity is low and no user interaction is required, so once an attacker holds administrative access, via default credentials, credential reuse, or a chained flaw, the path to code execution is straightforward.
The available records document exploit maturity only as proof-of-concept; none of them report confirmed exploitation in the wild.
What's Vulnerable
- Vendor: D-Link
- Product: R95 router (
cpe:2.3:h:d-link:r95) - Affected version: BE9500_1.00.16
- Component: DHMAPI,
/bin/ssi,systemfunction - Parameter:
NTPServer
Patch Status
The supplied NVD record lists no patch, fixed version, or vendor advisory. The CVE was published 2026-09-20 with a status of Received, meaning NVD analysis is still pending. Administrators should consult D-Link directly for firmware availability and, in the interim, restrict administrative access to the device's management interface.