| शीर्षक | DLink R95 1.01B06 CWE-78 |
|---|
| विवरण | The D-Link R95 BE9500 Wi-Fi 7 Smart Router (firmware version BE9500_1.00.16) contains a command injection vulnerability in the DHMAPI (SOAP over HTTPS) interface when processing `SetTimeSettings` requests. The user-controlled `<NTPServer>` field is stored into the configuration database **without any sanitization or validation** of shell metacharacters. Subsequently, when the configuration is synchronized to UCI (`ntpclient.@ntpserver[0].hostname`), the vulnerable backend service constructs and executes a shell command enclosed in double quotes via a `system()`-like call. By injecting backticks (```) into the `<NTPServer>` value, an attacker can achieve command substitution — the shell evaluates the injected content before executing the concatenated command, allowing arbitrary command execution with **root (uid=0)** privileges.
The attack requires a valid web management session (sid) obtained through authenticated access (tested with the administrator account Admin). This vulnerability is further amplified by the device's weak default credentials or potential authentication bypass issues, significantly expanding the real-world attack surface. |
|---|
| स्रोत | ⚠️ https://github.com/FoundTL/D-Link-R95-BE9500 |
|---|
| उपयोगकर्ता | Legion_TL (UID 100691) |
|---|
| सबमिशन | 23/08/2026 11:12 AM (28 दिन पहले) |
|---|
| संयम | 19/09/2026 11:12 AM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407917 [D-Link R95 BE9500_1.00.16 DHMAPI /bin/ssi system NTPServer अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|