Critical D-Link Flaw Enables Root Command Injection on Wi-Fi APs

Researchers have published technical details and a working proof-of-concept exploit for CVE-2026-95675, a critical command-injection vulnerability in D-Link’s DAP-1360 wireless access point. The flaw affects firmware version 6.14 and earlier across all hardware revisions. It is rated 9.8 under CVSSv3 in the article, although another section gives a 9.3 score.

The report says the vulnerability permits unauthenticated attackers to execute operating-system commands with root privileges through the device’s web management interface. No exploitation in the wild has been confirmed.

The issue lies in the `apply.cgi` system-check handler, which processes an IPv4 ping parameter. According to the researchers, the device builds a system `ping` command from the supplied value without sanitising it, then passes it to a command interpreter. An attacker able to reach the endpoint could therefore append shell metacharacters and run arbitrary commands. The article says this could allow changes to device settings and provide a foothold for attacks against connected networks.

D-Link retired the DAP-1360 product family in August 2020 and says it will not release a fix, stating that firmware development has ceased. The vendor recommends retiring the product because continued use may put connected devices at risk. Organisations should replace affected access points with supported hardware; if replacement is delayed, the administrative interface should be isolated from untrusted networks.