Security1 publisher2 min readPublished
Admin credentials are the only gate on D-Link's unfixed R95 command injection
D-Link says crafted NTPServer input on the R95 reaches an OS command call in /bin/ssi, and the published vector requires administrative privileges. Proof-of-concept code is public. The investigation is open.
The Watch · Security desk
What happened
- D-Link acknowledged CVE-2026-93958 in the R95, an OS command injection in the DHMAPI component where the NTPServer argument reaches the system function in /bin/ssi.
- The CVE Numbering Authority scored it 9.1 Critical under CVSS v3.1 and 9.4 Critical under CVSS v4.0.
- D-Link's advisory says a public proof-of-concept has been reported, and that the attack may be performed remotely with no user interaction but with elevated privileges.
- The only product listed is the R95 on reported version BE9500_1.00.16, with the status recorded as Under Investigation.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure With PR:H, an attacker needs an administrative session. An R95 whose management interface answers from the internet and accepts a reused or default admin password is one request away from command execution.
- constraint Network controls reduce who can reach the interface; they do not remove the injection. Owners who need remote management keep the exposure until D-Link ships firmware.
- contradiction The advisory sends owners to the AQUILA PRO app to check and upgrade while listing firmware availability as an open question, so an owner following the guidance may find nothing to install.
- decision Because lifecycle status is still unverified, R95 owners have to plan for retirement guidance, and budget replacement hardware accordingly.
The privilege requirement is the gate. The published v3.1 vector reads CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R [7]: network reachable, low attack complexity, no user interaction, scope changed, and privileges required high [7][15]. An attacker who already holds an administrative session on an R95 can put shell metacharacters into the NTPServer value and have them reach the system call in /bin/ssi without neutralization [2][19]. Without that session, the path starts somewhere else: default logins, reused admin passwords, or a second flaw in the authentication path.
Both published vectors carry E:P, proof-of-concept exploit maturity, which matches D-Link's statement that a public proof-of-concept has been reported [7][8][16][4]. The v3.1 string also carries RL:X and RC:R, remediation level not defined and report confidence reasonable [17]. The status line in the affected-product table says "Under Investigation" [5]. CVSS v4.0 puts the score 0.3 above v3.1, at 9.4 against 9.1, and both sit in the Critical band [6][18].
D-Link's interim guidance tells owners to use the AQUILA PRO mobile application to check and upgrade the device [10]. Among the things D-Link is still verifying, the same document lists "whether an updated firmware release is available or appropriate" [9]. The advisory does not name a fixed firmware version [20]. The rest of the guidance is network and credential work: keep management interfaces off the public internet, disable or restrict remote management, put firewall or access controls in front of device-management services, and use strong unique administrative credentials [10]. D-Link says that because elevated privileges are required, protecting administrative credentials and restricting access to management interfaces are particularly important while the investigation continues [12].
The verification list also covers the applicable hardware revisions, the regional product scope, the lifecycle status, and whether firmware other than BE9500_1.00.16 is affected [9][5]. An owner running a different build on an R95 cannot tell from this advisory whether the device is in scope. D-Link says it is reviewing the reported vulnerability, affected product scope, and available remediation options, and that if the affected product or firmware turns out to be unsupported, it will provide product retirement and replacement guidance [14][13].
What to watch
- Whether D-Link confirms hardware revisions and firmware builds other than BE9500_1.00.16 as affected. Each addition widens the installed base in scope.
- A firmware release for the R95, or a retirement and replacement notice if D-Link finds the product out of support.
- Scanning or exploitation activity against R95 management interfaces. Attacks there would show the public proof-of-concept being paired with credential access.