A critical OS command injection vulnerability in the D-Link R95 router allows an authenticated attacker to execute arbitrary system commands remotely.

This flaw involves OS command injection within the system function of the /bin/ssi file, specifically triggered by manipulating the NTPServer argument. While the CVSS vector indicates that high privileges are required for exploitation, the impact is severe, allowing an attacker to achieve full system compromise.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with elevated privileges on the affected device. This could lead to a total loss of confidentiality, integrity, and availability of the router, potentially serving as a pivot point for further attacks on the internal network. Given the critical CVSS score of 9.1, this vulnerability poses a significant risk to organizational infrastructure and network security.

Immediate Action: Since no official patch is currently identified, administrators should restrict management interface access to trusted IP addresses only and disable unnecessary remote administration features.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution or attempts to modify NTP configuration settings.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface, effectively isolating the vulnerable DHMAPI component from untrusted networks.

Public Exploit Available: Yes, a public proof of concept is available via the GitHub repository referenced in the CVE record.

The severity of this command injection vulnerability necessitates immediate attention to prevent unauthorized system access. Organizations currently using the D-Link R95 with firmware version BE9500_1.00.16 must prioritize isolating these devices from external access until a vendor-supplied firmware update is released and applied.