Critical severity · published Sep 20, 2026
CVE-2026-93958
D-Link R95 DHMAPI ssi system os command injection
9.1
CVSS
2.7%
EPSS
No
On KEV
Description
A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R9
R95 · D-Link
BE9500_1.00.16 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93958
github.com
https://github.com/FoundTL/D-Link-R95-BE9500
vuldb.com
https://vuldb.com/cve/CVE-2026-93958
vuldb.com
https://vuldb.com/submit/944149
vuldb.com
https://vuldb.com/vuln/407917
vuldb.com
https://vuldb.com/vuln/407917/cti
www.dlink.com
https://www.dlink.com/