EUVD-2026-83637
GHSA-964w-qqjq-2jm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain router admin access
-
DeliverySubmit crafted NTPServer value to DHMAPI
-
Exploit/bin/ssi passes input to system()
-
ExecutionInject shell metacharacters
-
PersistExecute OS commands on device
-
ImpactFull router compromise / pivot to LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the attacker can reach and authenticate to the router's DHMAPI management interface (the CVSS vector specifies PR:H, i.e. high/administrative privileges) and submit the NTPServer argument that /bin/ssi processes. Limiting factors: administrative access to the device's web/management interface is a prerequisite, so exploitation is post-authentication rather than anonymous; the flaw is specific to firmware R95 BE9500_1.00.16. No user interaction is required (UI:N). Realistically exploitable when admin credentials are default, weak, reused, or obtained via a separate flaw. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) scores 8.5 High, driven by full technical impact on a network device. The most consequential metric is PR:H - exploitation requires high privileges, meaning an authenticated administrator (or a session obtained via default/weak credentials or a chained auth bypass) rather than an anonymous internet attacker. This substantially tempers real-world urgency: an attacker who already holds router admin rights has significant control anyway, so the marginal gain is escalation from web-admin to OS shell. A public POC exists (VulDB-referenced GitHub repo), so 'publicly available exploit code exists,' but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation. The SC/SI/SA:H subsequent-system ratings appear generous for a single-device command injection and are worth independent verification. Net: a genuine High-severity command-injection flaw, but the PR:H gating makes it a targeted/post-auth risk rather than a mass-exploitable emergency. Note the CWE is CWE-78 (OS command injection); the input CWE field value should be read as such. |
| Exploit ScenarioDerived | An attacker with administrative access to the D-Link R95 router's DHMAPI interface submits a crafted NTPServer value containing shell metacharacters, which /bin/ssi passes unsanitized into a system() call, executing arbitrary OS commands on the device. A public proof-of-concept is available on GitHub (FoundTL/D-Link-R95-BE9500). Realistically this is reached after obtaining admin credentials (default, reused, phished, or via a separate auth flaw), after which the injection yields a root-level shell on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 20, 2026
OS command injection in the D-Link R95 (BE9500) router running firmware BE9500_1.00.16 allows an attacker to execute arbitrary operating-system commands on the device by supplying a crafted NTPServer argument that the /bin/ssi binary handles on behalf of the DHMAPI component. Exploitation requires reaching and authenticating to the router's management interface (PR:H in both the CVSS 4.0 vector and our independent CVSS 3.1 assessment), so this is a post-authentication flaw that becomes dangerous when admin credentials are default, weak, or reused. Publicly available exploit code exists (a public GitHub proof-of-concept), but no CISA KEV entry confirms active exploitation; the vulnerability scores 8.5 High under CVSS 4.0, driven by full confidentiality, integrity, and availability impact on the device.
Earlier versions of this analysis (1)
OS command injection in the D-Link R95 BE9500 router (firmware 1.00.16) lets an attacker who can reach the device's web management interface inject shell commands through the NTPServer argument processed by the DHMAPI handler in /bin/ssi, achieving full command execution on the device. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:H/UI:N with high confidentiality, integrity, and availability impact (score 9.4), while our independent assessment maps to CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and requiring no user interaction, but gated by the authenticated (PR:H) management session needed to submit NTP configuration. Publicly available exploit code exists (a PoC repository is referenced), making weaponization by less-skilled attackers realistic, although there is no indication of confirmed active exploitation in the wild or CISA KEV listing.
RemediationAI
No vendor-released patch was identified at time of analysis; the only vendor reference provided is the general D-Link site (https://www.dlink.com/), so affected users should monitor D-Link's security advisory channels and the VulDB entry (https://vuldb.com/vuln/407917) for an updated firmware build for the R95/BE9500 and apply it as soon as a fixed version is published. Until then, apply compensating controls that directly address the post-authentication, network-reachable nature of the flaw: change the default administrative credentials and enforce a strong, unique password so that PR:H cannot be satisfied with known defaults, disable WAN-side/remote management and UPnP exposure so the DHMAPI interface is reachable only from the trusted LAN, and segment or firewall the router's management interface to a dedicated administrative VLAN - noting that this trade-off blocks legitimate remote administration unless a trusted management path (for example, VPN) is provided. If NTP server configuration can be pushed through any alternate interface or provisioning mechanism, restrict those paths as well, and monitor router logs for anomalous outbound connections or unexpected process activity that would indicate command execution. Because publicly available exploit code exists, treat credential hygiene and management-plane exposure reduction as the highest-priority interim measures rather than relying on detection alone.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic OS command injection (CWE-78) in D-Link's DHMAPI management functionality: input supplied through the NTPServer parameter is not neutralized before being passed to a shell, so metacharacters embedded in the value are interpreted as commands by the underlying system. The vulnerable code path lives in the /bin/ssi binary in firmware BE9500_1.00.16, which handles server-side processing of management requests and translates configuration fields such as NTP server settings into system calls on the router's embedded Linux environment. The affected product is recorded as cpe:2.3:a:d-link:r95:*:*:*:*:*:*:*:* with the EUVD entry listing R95 BE9500_1.00.16 as the affected version. Because command execution occurs with the privileges of the management service, successful exploitation yields full control of the device's confidentiality, integrity, and availability (VC:H/VI:H/VA:H), and the CVSS 4.0 vector's subsequent-system metrics (SC:H/SI:H/SA:H) reflect the potential reach into downstream network segments. The attack is network-reachable and requires no user interaction (AV:N/AC:L/AT:N/UI:N), but the PR:H metric - reinforced by our independent assessment's CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - confirms that an administrative session on the management interface is a prerequisite.
Know when R95 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable admin interface with no user interaction (AV:N/AC:L/UI:N); DHMAPI command injection needs admin privileges (PR:H); root command execution gives full C/I/A but stays on one device (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Technical POC Analysis
CWE-78, OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
D-Link R95 (BE9500) routers running firmware BE9500_1.00.16 contain a high-severity post-authentication OS command injection that can give an attacker with management credentials full control over the device, affecting confidentiality, integrity, and availability. Public exploit code exists, and no vendor patch is currently available, so organizations using these routers-especially with default, weak, or reused admin passwords-face elevated risk until mitigations are applied. Leadership should prioritize identifying exposed devices and reducing management-plane access because a compromised router can disrupt connectivity and undermine trust in the network perimeter.
No vendor patch identified at time of analysis; restrict management interface to trusted networks/VPN, disable WAN-side administration, rotate default/weak admin credentials to strong unique values, segment or isolate D-Link R95 (BE9500) firmware BE9500_1.00.16 devices, and monitor for anomalous NTPServer or /bin/ssi command execution until a patch or replacement is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB