Remote Command Injection in D-Link R95 BE9500

CVE-2026-93958 describes a critical command injection vulnerability in the D-Link R95 BE9500 router running firmware version 1.00.16. The vulnerability resides within the DHMAPI component, specifically in the system function of the /bin/ssi binary. An unauthenticated remote attacker can exploit this by manipulating the NTPServer argument during the network time synchronization process. Successful exploitation allows for the execution of arbitrary operating system commands with elevated privileges on the affected device. Public exploit code is currently available, increasing the risk of exploitation by opportunistic actors targeting network infrastructure.

Impact

Successful exploitation leads to full remote code execution on the D-Link R95 BE9500 router. This could allow an attacker to gain persistent access, intercept network traffic, pivot into the internal network, or disable security features on the gateway, potentially affecting all connected clients within the environment.

Recommendation

Prioritize the identification of D-Link R95 BE9500 devices within the infrastructure. Monitor network traffic directed at these devices for patterns indicative of command injection attempts against the NTPServer parameter. Given the public availability of exploits for CVE-2026-93958, organizations should restrict management interface access to trusted administrative networks and apply any available vendor firmware patches immediately.