CVE-2026-93958

Executive Summary

CVE-2026-93958 is an OS command injection vulnerability in the D-Link R95 BE9500 router firmware version 1.00.16. The flaw resides in the system function within the /bin/ssi binary, part of the DHMAPI component, and is triggered via manipulation of the NTPServer argument. With a CVSS score of 9.1 (Critical), this remotely exploitable vulnerability allows an authenticated attacker with high privileges to execute arbitrary operating system commands, leading to complete compromise of the device's confidentiality, integrity, and availability. The exploit has been made public, significantly increasing the risk of widespread exploitation.

Technical Analysis

CVE-2026-93958 is classified as an OS command injection (CWE-77) vulnerability. The affected component is the DHMAPI interface implemented in the /bin/ssi binary of the D-Link R95 BE9500 firmware version 1.00.16. The vulnerability specifically affects the system function within that binary. The attack vector involves manipulating the NTPServer argument, which is presumably passed to the system function without adequate sanitization or validation.

In a typical OS command injection scenario, user-supplied input is concatenated into a command string that is then executed by a shell. If the input is not properly escaped or validated, an attacker can inject shell metacharacters (e.g., ;, |, &, backticks) to execute arbitrary commands. The system function in the /bin/ssi binary likely constructs a command such as ntpclient -s <NTPServer> or similar, where the NTPServer value is inserted directly. By supplying a value like ; reboot; or | telnetd -l /bin/sh, an attacker could execute arbitrary commands with the privileges of the process (likely root, given the embedded context).

The CVSS vector indicates that the attack is network-based (AV:N), requires low complexity (AC:L), and requires high privileges (PR:H). This suggests that the attacker must first authenticate to the device's management interface (e.g., web UI or API) with administrative credentials. No user interaction is required (UI:N), and the scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component itself, potentially impacting the entire device or network. The impact to confidentiality, integrity, and availability is high (C:H/I:H/A:H), reflecting the ability to execute arbitrary commands, read sensitive data, modify configurations, and cause denial of service.

The fact that the exploit has been made public means that technical details or proof-of-concept code may be available, lowering the barrier for attackers to develop working exploits. However, no specific PoC code or Nuclei template is currently tracked in this dataset. The vulnerability remains unpatched, with no vendor fix or workaround available.

Exploitation Scenarios

Based on the NVD description and the vulnerability class, the following attack chain can be inferred:

1. Reconnaissance and Target Identification: The attacker scans for internet-exposed D-Link R95 BE9500 devices. Shodan dorks such as product:"D-Link R95" or http.title:"D-Link" can identify potential targets. The device's web management interface is typically accessible on HTTP/HTTPS (ports 80/443) or via a custom port. The attacker confirms the firmware version, which can often be gleaned from the login page or specific API endpoints.

2. Authentication: Since the CVSS vector requires high privileges (PR:H), the attacker must obtain valid administrative credentials. This could be achieved through default credentials (if unchanged), credential stuffing, phishing, or prior compromise. Once authenticated, the attacker gains access to the DHMAPI interface.

3. Triggering the Vulnerability: The attacker sends a crafted request to the DHMAPI endpoint that handles NTP server configuration. The request includes a malicious NTPServer parameter value containing shell metacharacters. For example, a value like 8.8.8.8; telnetd -p 2323 -l /bin/sh; would cause the system function in /bin/ssi to execute the injected command. The exact API endpoint and request format are not detailed in the available description, but they likely involve an HTTP POST or GET request to a CGI or API route with the NTPServer parameter.

4. Payload Execution and Post-Exploitation: The injected command executes with the privileges of the /bin/ssi process, which is likely root. The attacker can then establish a reverse shell, add persistent backdoors, exfiltrate configuration data, pivot into the internal network, or launch further attacks. Given the changed scope (S:C), the compromise could extend to other devices on the network.

No public PoC is available in this dataset, but the attack chain is consistent with known OS command injection patterns in embedded devices. The lack of details about the exact endpoint and parameter format means that attackers may need to reverse-engineer the firmware or rely on public exploit disclosures.

Impact Assessment

The impact of CVE-2026-93958 is critical. With a CVSS base score of 9.1, the vulnerability allows an authenticated attacker to execute arbitrary OS commands on the router. This leads to:

• Confidentiality Impact (High): Attackers can read sensitive information such as device configuration, Wi-Fi passwords, VPN keys, and network traffic.
• Integrity Impact (High): Attackers can modify device settings, inject malicious firmware, or alter network traffic.
• Availability Impact (High): Attackers can crash the device, disable network services, or use it as a botnet node.

The blast radius includes not only the compromised router but also all devices connected to it. The router can be used as a pivot point to attack internal systems, intercept traffic, or conduct man-in-the-middle attacks. The change in scope (S:C) indicates that the vulnerability can affect resources beyond the vulnerable component, potentially the entire network.

Given that the exploit is public and no patch exists, the risk of exploitation is high. The EPSS score is not yet available, but the public exploit status suggests that attackers may quickly incorporate it into their toolkits. CISA KEV status is "NO," but this could change if exploitation is observed in the wild.

Detection Guidance

Sigma Rule

title: D-Link R95 BE9500 OS Command Injection via NTPServer Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-93958 by injecting commands into the NTPServer parameter of the DHMAPI interface.
author: Threat Intelligence Team
date: 2026-06-15
logsource:
  category: webserver
  product: dlink
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains: '/DHMAPI'
    cs-uri-query|contains: 'NTPServer'
  keywords:
    - ';'
    - '|'
    - '`'
    - '$('
    - '&&'
  condition: selection and keywords
falsepositives:
  - Legitimate NTP server addresses containing special characters (unlikely)
level: high

YARA Rule

rule CVE_2026_93958_DLink_R95_CommandInjection
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-93958 in D-Link R95 BE9500 firmware"
        author = "Threat Intelligence Team"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93958"
        hash = "unknown"
    strings:
        $s1 = "NTPServer" ascii wide nocase
        $s2 = "DHMAPI" ascii wide nocase
        $s3 = "system" ascii wide nocase
        $s4 = "; " ascii wide
        $s5 = "| " ascii wide
        $s6 = "`" ascii wide
    condition:
        uint16(0) == 0x5A4D and // MZ header for PE
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93958 D-Link R95 BE9500 OS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/DHMAPI"; http_uri; content:"NTPServer"; http_client_body; pcre:"/NTPServer=[^&]*[;|`$]/i"; reference:cve,2026-93958; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, process.pid
  [process where event.type == "start" and process.name in ("sh", "bash", "telnetd", "nc") and process.parent.name == "ssi"]

Splunk SPL Query

index=web OR index=network sourcetype=access_combined OR sourcetype=suricata
| search (uri_path="/DHMAPI*" AND (uri_query="*NTPServer*" OR form_data="*NTPServer*")) 
| regex uri_query="NTPServer=[^&]*[;|`$&]"
| table _time, src_ip, dest_ip, uri_path, uri_query, status

Wazuh OSSEC Rule

<group name="dlink,web,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>NTPServer=</match>
    <regex>NTPServer=[^&]*[;|`$]</regex>
    <description>CVE-2026-93958: D-Link R95 BE9500 OS Command Injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict access to the router's management interface. Disable remote management (WAN access) if not required. If remote management is necessary, restrict access to trusted IP addresses via firewall rules.
   • Change default administrative credentials to strong, unique passwords.
   • Monitor for suspicious outbound connections from the router, especially to unknown IPs or on unusual ports.
   • Disable the NTP server configuration feature if not needed, or ensure that only trusted NTP servers are used and that input validation is applied at the network perimeter (though this is a workaround, not a fix).
   • Apply network segmentation to isolate IoT devices from critical systems.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor D-Link's security advisory page for updates. Once a firmware update is released, apply it immediately.
   • If the device is no longer supported, consider replacing it with a supported model.

3. Long-term Hardening:

   • Implement a vulnerability management program that includes regular firmware updates for network devices.
   • Use a Web Application Firewall (WAF) to filter malicious requests to the management interface, although this may not be feasible for embedded devices.
   • Conduct regular security audits and penetration testing of network infrastructure.
   • Enable logging and monitoring for all administrative actions on the router.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-93958
2. D-Link Security Advisories: https://www.dlink.com/en/security-bulletin (monitor for updates)
3. CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
4. MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Public Exploit Disclosure (if available): Search for "CVE-2026-93958 D-Link R95" on exploit databases or security researcher blogs.

No specific threat actor campaigns or exploit-in-the-wild evidence has been observed yet, but the public exploit status increases the likelihood of future exploitation. Continuous monitoring is recommended.