A vulnerability was found in D-Link R95 BE9500_1.00.16.

CVE-2026-93958 is an OS command injection in the D-Link R95 BE9500 Wi-Fi 7 Smart Router, firmware version BE9500_1.00.16. The DHMAPI SOAP interface at /DHMAPI/ accepts a SetTimeSettings action whose <NTPServer> XML field is passed — unsanitized — into a system() call inside /bin/ssi, which runs as root. An attacker who can log in to the router's admin panel can inject backtick-enclosed shell commands (e.g., ` id > /www/m_id.txt ) and achieve full root-level code execution on the device. The public PoC (HackSpeak/CVE-2026-93958`) automates the entire chain including HMAC-SHA256-authenticated login, payload injection, and output retrieval.

The vendor CVSS of 9.1 CRITICAL dramatically overstates the risk for enterprise environments. The vector PR:H confirms admin-level authentication is required — the attacker already needs the router's admin password. Several clickbait write-ups mischaracterize this as 'unauthenticated,' but the PoC itself performs a full login handshake first. The D-Link R95 is a consumer Wi-Fi 7 router sold at retail for home networking — it is not enterprise-grade network infrastructure. For a security team managing 10,000 hosts, this device likely appears nowhere in asset inventory, and if it does, it is shadow IT in a branch closet. The Scope: Changed rating reflects that a compromised router can impact downstream hosts, which is theoretically true but practically bounded to a single home or micro-office LAN segment. This is a MEDIUM for enterprise defenders.

1. Identify and remove D-Link R95 units from any managed network — This is a consumer router. It should not exist in enterprise infrastructure. Run a network scan for the R95's DHMAPI SOAP fingerprint or HTTP title. If found, replace with enterprise-grade equipment. No mitigation SLA applies at MEDIUM — go straight to the 365-day noisgate remediation SLA window, but given the trivial fix (swap the hardware), aim for 30 days.
2. Change default admin credentials immediately on any discovered units — D-Link routers commonly ship with admin/blank. The entire attack chain depends on valid admin credentials. Changing the password to a strong, unique value neutralizes the PoC entirely. Do this within hours if any units are found.
3. Disable WAN remote management — Ensure the 'Enable Remote Management' option in the R95 admin panel is turned off. This restricts the DHMAPI interface to LAN-only access, eliminating any internet-facing attack surface.
4. Segment consumer devices on a dedicated VLAN — If removal is not immediately possible, place the R95 on an isolated VLAN with no route to corporate resources. This contains the blast radius of any compromise to the isolated segment.
5. Monitor for D-Link firmware updates — D-Link lists the patch as 'In Review.' Subscribe to D-Link security advisories at https://www.dlink.com/en/security-bulletin and apply the firmware update when released.

Run this script from any host that has HTTP(S) connectivity to the D-Link R95 management interface (typically a LAN host). Invoke with python3 check_cve_2026_93958.py <router_ip>. No special privileges required — it performs an unauthenticated HTTPS GET to fingerprint the firmware version.

#!/usr/bin/env python3
"""check_cve_2026_93958.py — Check D-Link R95 firmware version for CVE-2026-93958.
Usage: python3 check_cve_2026_93958.py <router_ip>
Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
"""
import sys
import ssl
import urllib.request
import re

VULNERABLE_VERSIONS = ["1.00.16", "1.01B06"]

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 check_cve_2026_93958.py <router_ip>")
        sys.exit(2)
    host = sys.argv[1]
    url = f"https://{host}/"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        req = urllib.request.Request(url, headers={"User-Agent": "noisgate-check/1.0"})
        resp = urllib.request.urlopen(req, timeout=10, context=ctx)
        body = resp.read().decode("utf-8", errors="ignore")
    except Exception as e:
        print(f"UNKNOWN — could not connect to {host}: {e}")
        sys.exit(2)
    # Check if this is a D-Link R95
    if "R95" not in body and "BE9500" not in body and "D-Link" not in body:
        print(f"UNKNOWN — {host} does not appear to be a D-Link R95.")
        sys.exit(2)
    # Try to extract firmware version from page content
    version_match = re.search(r'(?:firmware|version|ver)[^0-9]*(\d+\.\d+[A-Za-z]*\.?\d*[A-Za-z]*\d*)', body, re.IGNORECASE)
    if not version_match:
        # Try alternate patterns
        version_match = re.search(r'BE9500[_ ]*(\d+\.\d+\.\d+)', body, re.IGNORECASE)
    if not version_match:
        # Try DHMAPI info endpoint
        try:
            info_url = f"https://{host}/DHMAPI/"
            info_req = urllib.request.Request(info_url, headers={"User-Agent": "noisgate-check/1.0"})
            info_resp = urllib.request.urlopen(info_req, timeout=10, context=ctx)
            info_body = info_resp.read().decode("utf-8", errors="ignore")
            version_match = re.search(r'<FirmwareVersion>([^<]+)</FirmwareVersion>', info_body)
            if not version_match:
                version_match = re.search(r'<ModelName>[^<]*R95[^<]*</ModelName>', info_body)
                if version_match:
                    fw_match = re.search(r'(\d+\.\d+\.\d+)', info_body)
                    if fw_match:
                        version_match = fw_match
        except Exception:
            pass
    if version_match:
        fw_version = version_match.group(1).strip()
        print(f"Detected firmware version: {fw_version}")
        for vuln_ver in VULNERABLE_VERSIONS:
            if vuln_ver in fw_version:
                print(f"VULNERABLE — firmware {fw_version} matches known vulnerable version {vuln_ver} (CVE-2026-93958).")
                sys.exit(1)
        print(f"PATCHED — firmware {fw_version} does not match known vulnerable versions.")
        sys.exit(0)
    else:
        print(f"UNKNOWN — detected a D-Link device at {host} but could not determine firmware version. Verify manually via admin panel > Status.")
        sys.exit(2)

if __name__ == "__main__":
    main()

1. GitHub PoC — HackSpeak/CVE-2026-93958
2. TheHackerWire — CVE-2026-93958 OS Command Injection Analysis
3. OffSeq Threat Radar — CVE-2026-93958
4. Strix.ai — CVE-2026-93958 Fix & Details
5. D-Link R95 Product Page
6. Sploitus — PoC Exploit for CVE-2026-93958
7. D-Link R95 User Guide — device.report