CVE-2026-93958

CRITICALCVSS 9.1

Description

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Timeline

Published:September 20th, 2026 2:16 AM

Last modified:September 21st, 2026 7:17 PM

CVSS Scoring

CVSS v3: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2: 8.3

Weaknesses (CWE)

CWE-77 CWE-78

References & Reports

Advisories, patches, and third-party reports

https://github.com/FoundTL/D-Link-R95-BE9500
https://vuldb.com/cve/CVE-2026-93958
https://vuldb.com/submit/944149
https://vuldb.com/vuln/407917
https://vuldb.com/vuln/407917/cti
https://www.dlink.com/

Source: NIST NVD · Data may lag official sources by up to one minute