CVE-2026-95675 in DAP-1360
Summary
by MITRE • 09/22/2026
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the local network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The D-Link DAP-1360 wireless access point, specifically in firmware versions 6.14 and earlier, suffers from a critical unauthenticated remote code execution vulnerability within its web management interface. This flaw allows any attacker with network connectivity to the device to bypass authentication mechanisms entirely and execute arbitrary system commands with root privileges. The absence of required credentials for this specific attack vector represents a severe breakdown in access control logic, enabling adversaries to gain complete administrative control over the hardware without prior authorization or interaction from legitimate users.
From a technical perspective, the vulnerability stems from insufficient validation and sanitization of input data processed by the web server component responsible for handling management requests. By sending specifically crafted HTTP requests containing malicious payloads, an attacker can inject shell commands that are executed directly on the underlying operating system with elevated privileges. This type of flaw is characteristic of improper access control failures where security checks are either missing or easily circumvented through parameter manipulation in request headers or body content. The ability to execute code as root means there are no further privilege escalation steps required, granting immediate full system compromise upon successful exploitation.
The operational impact of this vulnerability is profound and extends beyond the individual device itself. Once an attacker achieves remote code execution with root access, they can persistently modify the device configuration to maintain long-term access even after reboots or firmware updates that do not patch the flaw. Furthermore, because wireless access points often serve as gateways between external networks and internal local area networks, a compromised DAP-1360 becomes an ideal pivot point for lateral movement. Attackers can use the device to scan internal subnets, intercept unencrypted traffic, or launch further attacks against other devices on the network that may have weaker security postures than the access point itself.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-287, which describes Improper Authentication, and specifically relates to scenarios where authentication is bypassed entirely. In terms of offensive cybersecurity frameworks such as MITRE ATT&CK, this exploit maps directly to techniques involving Remote Services like Web Session Hijacking or Command and Scripting Interpreter execution via network services. The lack of input validation also touches upon CWE-20 Improper Input Validation, which often serves as the root cause allowing command injection vectors to succeed when combined with insufficient access controls.
Mitigation strategies must prioritize immediate remediation due to the severity of unauthenticated remote code execution. Organizations should update the firmware on all DAP-1360 devices to a version later than 6.14, where this specific authentication bypass has been addressed by the vendor. If updating is not immediately feasible, network segmentation policies should be enforced to restrict management interface access only from trusted administrative subnets using firewall rules or VLAN isolation. Additionally, disabling remote web management features if they are not strictly necessary reduces the attack surface available to external adversaries. Regular vulnerability scanning and monitoring for anomalous outbound connections can help detect potential exploitation attempts before significant damage occurs within the network infrastructure.