Overview
A critical OS command injection vulnerability has been disclosed in the D-Link R95 (BE9500) Wi-Fi 7 smart router, tracked as CVE-2026-93958. The flaw sits in the SetTimeSettings handler of the router's DHMAPI SOAP interface, implemented in the root-privileged /bin/ssi binary, and lets an attacker who can reach the web management interface inject arbitrary shell commands that execute as root.
A working proof-of-concept exploit — including a Python script that opens an interactive root shell — has already been published on GitHub, making this a high-urgency patch-or-mitigate item for anyone running the affected firmware.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93958 |
| Severity | Critical (CVSS 3.1: 9.1) |
| Component | DHMAPI SOAP interface, /bin/ssi |
| Attack Vector | Network |
| Authentication | Valid admin web session (sid) required |
| Privileges Gained | root |
| Public PoC | Yes — HackSpeak/CVE-2026-93958 on GitHub |
How It Works
The vulnerable code path is the SetTimeSettings handler, which accepts an NTPServer field from an authenticated SOAP request. That value is copied into a stack buffer with a 63-byte length cap — a buffer-size limit, not an input-sanitization check — and then written verbatim into the router's internal configuration store.
The actual injection fires later, when that configuration is synced to UCI (ntpclient.@ntpserver[0].hostname). At that point the backend constructs a shell command string wrapping the stored value in double quotes and passes it to a system()-style call. Because the NTPServer value was never filtered for shell metacharacters, an attacker can embed backticks to trigger command substitution — turning a routine NTP configuration update into arbitrary root command execution.
Exploitation requires a valid authenticated admin session on the router's management interface, but no further user interaction is needed once that session is established, and the request can be sent remotely if the management interface is reachable.
Impact Assessment
Who Is At Risk
- D-Link R95 (BE9500) routers running firmware 1.00.16 with the web management interface reachable by an attacker who holds or can obtain valid admin credentials
- Deployments that expose router administration to the WAN side, or that reuse default/weak admin credentials on the LAN
- Managed environments (ISPs, MSPs) that provision this router model at scale with shared or weak credential baselines
Why Authentication Doesn't Blunt This Much
Because home and small-office routers are frequently left on default credentials, and because credential-stuffing tools routinely target consumer router admin panels, the authentication requirement here is a speed bump rather than a real barrier. Combined with a public, ready-to-run PoC, this should be treated similarly to an unauthenticated flaw for risk-prioritization purposes.
Mitigation
- Do not expose the router's web management interface to the WAN/internet. Restrict administration to trusted LAN devices only.
- Change default admin credentials immediately and use a strong, unique password for the router's admin account.
- Monitor D-Link's security advisories for a firmware update addressing CVE-2026-93958 and apply it as soon as it is available.
- Watch for unexpected outbound connections or processes originating from the router if you have any visibility into its behavior (e.g., via ISP-side monitoring or a downstream firewall).
- Where possible, replace or isolate affected devices behind a trusted router/firewall until a patch ships.
Background
This is the latest in a long line of command injection flaws found in D-Link's consumer and SMB router firmware, where administrative APIs frequently pass user-supplied configuration fields straight into shell commands without sanitization. Given the availability of a public exploit, defenders should assume opportunistic scanning and exploitation attempts against internet-exposed management interfaces are likely.