CVE-2026-93958

🗓️ 20 Sep 2026 01:15:12Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 50 Views🌐 WEB

Remote OS command injection in D-Link R95 DHMAPI via NTPServer argument in /bin/ssi.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2026-93958	20 Sep 202613:10	–	githubexploit
GithubExploit	Exploit for CVE-2026-93958	28 Sep 202608:13	–	githubexploit
BDU FSTEC	The vulnerability of the /bin/ssi file in the DHMAPI component of D-Link R95 router software allows a hacker to execute arbitrary code and completely compromise the device.	30 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-93958	19 Sep 202620:29	–	circl
Cvelist	CVE-2026-93958 D-Link R95 DHMAPI ssi system os command injection	20 Sep 202601:15	–	cvelist
EUVD	EUVD-2026-83637	20 Sep 202601:15	–	euvd
Kitploit	CVE-2026-93958	4 Oct 202621:34	–	kitploit
NVD	CVE-2026-93958	20 Sep 202602:16	–	nvd
Positive Technologies	PT-2026-95899	23 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-93958: Improper Neutralization of Special Elements used in an OS Command	20 Sep 202600:00	–	rapid7

Vulners

Node

dlink r95Matchbe9500_1.00.16

[
  {
    "vendor": "D-Link",
    "product": "R95",
    "versions": [
      {
        "version": "BE9500_1.00.16",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:h:d-link:r95:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "DHMAPI"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/submit/944149
github	www.github.com/FoundTL/D-Link-R95-BE9500
dlink	www.dlink.com/
vuldb	www.vuldb.com/vuln/407917
vuldb	www.vuldb.com/vuln/407917/cti
vuldb	www.vuldb.com/cve/CVE-2026-93958

Parameter	Position	Path	Description	CWE
NTPServer	request body	/DHMAPI/	Authenticated command injection via SetTimeSettings NTPServer in DHMAPI; value stored without sanitization and later executed by a shell as root.	CWE-77, CWE-78

21 Sep 2026 19:17Current

7.8High risk

Vulners AI Score7.8

CVSS 28.3

CVSS 3.19.1

CVSS 39.1

CVSS 49.4

EPSS0.02702

SSVC