Loading vulnerability…
Authenticated OS Command Injection in D-Link R95 DHMAPI
CVE-2026-93958 is an OS command injection vulnerability affecting the D-Link R95 BE9500 Wi-Fi 7 Smart Router running firmware BE9500_1.00.16. The DHMAPI backend insufficiently sanitizes the NTPServer argument in SetTimeSettings requests before incorporating it into a shell command executed through system(). An authenticated remote attacker with administrative privileges can supply shell metacharacters to execute arbitrary operating-system commands as root. Exploitation requires no additional user interaction, and a public proof-of-concept exploit is available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the router's confidentiality, integrity, and availability through root-level command execution. An attacker could access sensitive device data, modify DNS settings, routing tables and firewall rules, intercept or redirect traffic, disrupt connectivity, establish persistence, or use the router to pivot into reachable internal networks.
If you can’t patch tonight, do this now.
Disable WAN-based remote administration and restrict management-interface access to trusted administrative networks and authorized source addresses. Use strong, unique administrative credentials and replace default credentials. Monitor for unexpected NTP-server changes, suspicious NTPServer values in DHMAPI requests, unauthorized configuration changes, unusual outbound connections, traffic redirection, and unexpected processes or reboots. Isolate affected routers where management access cannot be adequately restricted.
Patch, then assume compromise.
Upgrade to a vendor-provided firmware release explicitly fixing CVE-2026-93958 when available. No official patch or fixed firmware version was recorded as of September 20, 2026; subsequent patch availability is not established. Inventory affected routers, verify firmware versions, and monitor D-Link security guidance. Consider replacing affected devices if a fix is unavailable.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.