VulnSocial

CVE-2026-93958Disclosure

LOWCVSS 8.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-77CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 7 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 4 signals
  • Technical details provided in 6 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 3 mentions (2026-09-20); latest day: 1
  • 7 total mentions across 5 days

Deep dive

Activity timeline7 mentions / 5d
01223Mentions · 2026-09-19: 1Mentions · 2026-09-20: 3Mentions · 2026-09-21: 1Mentions · 2026-09-25: 1Mentions · 2026-10-26: 1PoC Mentioned / Linked · 2026-09-20: 2PoC Mentioned / Linked · 2026-09-21: 1PoC Mentioned / Linked · 2026-09-25: 1Exploit Tool / Code · 2026-09-21: 1Technical Details · 2026-09-20: 3Technical Details · 2026-09-21: 1Technical Details · 2026-09-25: 1Technical Details · 2026-10-26: 109-1909-2009-2109-2510-26
Signal classification3 categories
Disclosure
342.9%
PoC
342.9%
Exploit
114.3%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-09-191
Disclosure1
2026-09-203
Disclosure1PoC2
2026-09-211
Exploit1
2026-09-251
PoC1
2026-10-261
Disclosure1
Full discourse7 posts
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 CVE-2026-93958 — D-Link R95 (BE9500) Wi-Fi 7 router'larındaki authenticated command injection açığı için PoC/EXP yayınlandı. DHMAPI SetTimeSettings isteğindeki NTPServer parametresi üzerinden komut çalıştırılabiliyor ve /bin/ssi root yetkileriyle çalıştığı için root RCE elde edilebiliyor. CVSS skoru: 9.1 (Critical) ve Authentication gerekli. https://github.com/HackSpeak/CVE-2026-93958

    Post summary

    The tweet announces a PoC/EXP for CVE‑2026‑93958, a critical authenticated command injection in D‑Link R95 (BE9500) Wi‑Fi 7 routers that enables root RCE via the NTPServer parameter, with CVSS 9.1, and includes a GitHub link.

    01043711
    2.5K followersView on X
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-93958 PT ID: PT-2026-95899 Vendor: D-Link Product: R95 Description: A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. References: • https://dbu.gs/vulnerability/PT-2026-95899 • https://github.com/hackspeak/cve-2026-93958

    Post summary

    A public exploit for CVE-2026-93958 (D-Link R95 OS command injection via NTPServer in DHMAPI) has been released on GitHub; no patch or active exploitation reporting is mentioned.

    01041804
    3.7K followersView on X
  • Ryx@PadhiyarRushi
    PoC

    D-Link R95 BE9500 has a command-injection flaw hiding in its NTP configuration path. CVE-2026-93958 — CVSS 9.4 The vulnerable flow involves: "DHMAPI → /bin/ssi → system() → NTPServer" Improper handling of the NTPServer argument can result in OS command injection. Affected firmware: BE9500_1.00.16 A public PoC is already available. D-Link currently lists the issue as under investigation. https://github.com/FoundTL/D-Link-R95-BE9500 #Cybersecurity #Infosec #IoT #DLink #Router #CommandInjection

    Post summary

    The text announces CVE-2026-93958 (CVSS 9.4 command injection in D-Link R95 BE9500 NTP handling) with a public PoC available on GitHub, while the vendor has the issue under investigation with no patch yet released.

    00031327
    954 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    A new vulnerability with increased severity was disclosed for D-Link R95 (CVE-2026-93958) https://vuldb.com/vuln/407917

    Post summary

    The text announces the disclosure of a new vulnerability (CVE-2026-93958) affecting D-Link R95 with increased severity, referencing a VulDB entry for details.

    00020166
    2.3K followersView on X
  • Hugo | DevOps | Cybersecurity@HugoValters
    Disclosure

    CVE-2026-93958: OS command injection in D-Link R95 BE9500 (DHMAPI, NTPServer arg). CVSS 9.1, remote, public exploit, no patch yet. Update immediately. #CVE #infosec #DLink https://www.valtersit.com/cve/CVE-2026-93958/ #DLink #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE-2026-93958, detailing an OS command injection vulnerability in D-Link R95 BE9500 with CVSS 9.1 and remote access, while explicitly stating no patch is currently available. It serves as a general vulnerability disclosure without providing named exploit code, tool references, or evidence of active in-the-wild exploitation.

    0000044
    1.1K followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    CVE-2026-93958 (CVSS 9.1) affects D-Link R95 BE9500_1.00.16 routers. Review firmware and device usage if present: https://nvd.nist.gov/vuln/detail/CVE-2026-93958 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/DwkUHEEGEt

    Post summary

    The tweet announces a high-severity vulnerability (CVE-2026-93958) in D-Link routers, providing the CVSS score and affected firmware version, and directs users to the NVD entry for further details.

    0000040
    97 followersView on X
  • ThreatAft@ThreatAft
    PoC

    🚨 CVE-2026-93958 — CVSS 9.4 Critical OS command injection in D-Link R95 BE9500 routers. Authenticated attackers can execute commands as root via the NTPServer parameter. Public PoC available. No fixed version recorded. 🔗 https://threataft.com/articles/cve-2026-93958-d-link-r95-os-command-injection?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel https://t.co/ymCJZLSXhi

    Post summary

    The tweet discloses CVE-2026-93958, a critical OS command injection in D-Link routers, notes a public PoC is available, and states no fixed version is recorded.

    0000066
    44 followersView on X

Explore more

Back to dashboard