External risk intelligence

D-Link DAP-1360 Unauthenticated Root Command Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-95675

The vulnerability affects a network device's web management interface. These devices are frequently deployed at the edge of local networks, and web management interfaces for such hardware are commonly accessible over the network, making them a typical target for remote access or management exposure.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated remote code execution vulnerability exists in the web management interface of certain D-Link devices. This flaw allows attackers to execute commands with the highest privileges, potentially leading to full device compromise and use as a pivot point into the local network. The main concern at this time is confirming relevance and exposure within your environment.

Attackers can remotely take full control.
This impacts network edge devices.
Confirm if these devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the device's web management interface. This allows them to execute arbitrary commands with root privileges, leading to complete compromise of the device. The compromised device can then be used to alter its configuration permanently and act as an entry point into the local network.

No authentication needed for access.
Triggered by crafted web requests.
Full device compromise and network pivot.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected D-Link devices. When supported by the advisory, this could enable full device compromise, persistent configuration modification, and use of the device as a pivot point into a local network.

Device configuration and control at risk.
Unauthenticated crafted requests to web interface.
Device compromise and network pivot point.

Operational Fix

Recommended remediation, mitigation, and detection steps

The D-Link DAP-1360 firmware vulnerability, allowing unauthenticated remote code execution, likely impacts network infrastructure or endpoint device teams responsible for managing network access points. The first practical step is to identify all deployed DAP-1360 devices, assess their network exposure, and confirm their business criticality to prioritize remediation efforts with the accountable owner.

Network and infrastructure teams own resolution.
Verify device exposure and network reachability.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DAP-1360?

The D-Link DAP-1360 is a wireless access point often used to extend network range or bridge devices to a wireless signal. It serves as a network infrastructure component that manages connectivity for various devices within a home or office environment.

What is the weakness class for CVE-2026-95675?

This vulnerability is classified as CWE-78, also known as Improper Neutralization of Special Elements used in an OS Command. In plain terms, the software fails to properly filter input, allowing an attacker to inject and execute their own system-level commands through the device's web management interface.

How does an attacker trigger CVE-2026-95675?

An attacker triggers this by sending specially crafted web requests to the device's management interface. Because the vulnerability does not require any login credentials, it cannot be triggered by standard user activity; it requires the device to be reachable over the network to accept these malicious inputs.

Is my device at risk per Halo Surface Signal?

Halo Surface Signal indicates that because this device functions as a network edge component, it is frequently placed where its web management interface may be reachable over the network. This accessibility makes it a target for remote actors, so you should care if your DAP-1360 units are configured to be reachable beyond your immediate, secured local management segment.

What is the first step to address this CVE?

Your priority is to inventory your environment to locate all active D-Link DAP-1360 units. Once identified, evaluate their placement to determine if they are exposed to untrusted networks and coordinate with your infrastructure team to plan and implement necessary firmware updates or access restrictions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.