CVE-2026-93958: D-Link R95 BE9500 RCE Vulnerability

CVE-2026-93958 Overview

CVE-2026-93958 is an operating system (OS) command injection vulnerability in the D-Link R95 BE9500 router running firmware version 1.00.16. The flaw resides in the system function within the /bin/ssi binary, part of the DHMAPI component. Attackers manipulate the NTPServer argument to inject arbitrary shell commands that execute on the underlying operating system. The issue is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. A public proof-of-concept exists in the FoundTL GitHub repository, increasing the likelihood of opportunistic exploitation.

Critical Impact

Authenticated attackers can execute arbitrary OS commands remotely on affected D-Link R95 BE9500 routers, leading to full device compromise and lateral movement into connected networks.

Affected Products

• D-Link R95 BE9500 router
• Firmware version 1.00.16
• DHMAPI component (/bin/ssi binary)

Discovery Timeline

• 2026-09-20 - CVE-2026-93958 published to the National Vulnerability Database (NVD)
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93958

Vulnerability Analysis

The vulnerability sits in the DHMAPI handler exposed by the /bin/ssi binary on the D-Link R95 BE9500. When the router processes configuration requests that set the Network Time Protocol (NTP) server, the value supplied through the NTPServer parameter is passed directly to a system call. Because the binary does not sanitize or escape shell metacharacters, attackers append arbitrary commands using standard shell separators.

Successful exploitation yields command execution in the security context of the process invoking system, typically root on embedded routers. This grants full control over network traffic, credentials stored on the device, and any downstream client. The attack is remotely reachable over the network, though it requires high privileges according to the CVSS 4.0 vector, indicating authenticated access to the management interface is a prerequisite.

The exploit is publicly available, and the Exploit Prediction Scoring System (EPSS) probability places this issue in the upper tier of likely-exploited vulnerabilities relative to the broader CVE population.

Root Cause

The root cause is missing input neutralization in the DHMAPI request handler. User-controlled data flows from the HTTP parameter NTPServer into a system() invocation without validation, allow-listing, or shell escaping. Any character interpreted by the shell (;, |, &, backticks, $()) becomes a command boundary.

Attack Vector

An authenticated attacker sends a crafted request to the DHMAPI endpoint served by /bin/ssi, supplying an NTPServer value that includes shell metacharacters followed by attacker-chosen commands. The router concatenates the value into a shell command line and executes it. The attacker receives command execution without any user interaction on the victim side.

The vulnerability mechanism follows the pattern of injecting a payload such as a benign hostname concatenated with a shell separator and a follow-on command. Refer to the public proof-of-concept for the specific request structure.

Detection Methods for CVE-2026-93958

Indicators of Compromise

• Unexpected outbound connections initiated by the router to attacker-controlled IP addresses or hostnames.
• HTTP requests to DHMAPI endpoints containing shell metacharacters (;, |, &, `, $() in the NTPServer parameter.
• New or modified processes on the router that are not part of the stock firmware baseline.
• Configuration changes to NTP settings that occur outside of change-control windows.

Detection Strategies

• Inspect management-plane traffic for POST or GET requests targeting DHMAPI handlers with suspicious NTPServer values.
• Correlate router administrative logins with subsequent NTP configuration changes to identify anomalous administrative activity.
• Enable syslog forwarding from the router to a centralized log platform and alert on shell-related strings appearing in configuration parameters.

Monitoring Recommendations

• Forward D-Link R95 syslog and web-management access logs to a centralized analytics platform for retention and query.
• Baseline expected NTP servers and alert on deviations from that allow-list.
• Monitor for unexpected DNS lookups or outbound TCP sessions from the router itself, which typically should not initiate arbitrary egress.

How to Mitigate CVE-2026-93958

Immediate Actions Required

• Restrict access to the router's web management interface to trusted management VLANs only.
• Rotate administrative credentials for the R95 BE9500 and enforce strong, unique passwords.
• Audit current NTP configuration for unexpected values and reset to known-good servers.
• Review router logs and network telemetry for prior exploitation attempts against the DHMAPI endpoint.

Patch Information

At the time of publication, no vendor advisory or firmware update has been referenced in NVD for CVE-2026-93958. Monitor the D-Link official site and the VulDB entry for CVE-2026-93958 for firmware releases addressing the DHMAPI NTPServer handling in /bin/ssi.

Workarounds

• Disable remote (WAN-side) management on the R95 BE9500 to reduce the exploitable attack surface.
• Place the router's management interface behind a jump host or VPN accessible only to administrators.
• Apply access control lists (ACLs) restricting HTTP/HTTPS management access to specific administrator source addresses.
• Segment the router from sensitive internal networks so that compromise does not immediately expose critical systems.

# Example: restrict management access to a single admin subnet using an upstream firewall
# Allow only 10.10.50.0/24 to reach the router management interface at 192.0.2.1
iptables -A FORWARD -s 10.10.50.0/24 -d 192.0.2.1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 80  -j DROP