{"id":"CVE-2026-95675","published":"2026-09-22T13:49:12Z","modified":"2026-10-01T19:19:37Z","title":"D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface","vendor":"D-LINK","product":"DAP-1360","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-LINK","product":"DAP-1360","versions":["<= 6.14"]}],"description":{"text":"D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the local network.","provenance":"source","from":"CVE.org"},"summary":{"text":"The D-Link DAP-1360 access point's web management interface, in firmware 6.14 and earlier, contains an OS command injection flaw that lets it run commands without authentication. A remote attacker with network access to the web interface, requiring no credentials and no user interaction, can execute arbitrary commands as root, fully compromising the device, persistently altering its configuration, and using it to pivot into the local network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:47Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02057,"percentile":0.81272,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-05","exploitedFirstSeen":"2026-10-05","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-95675","date":"2026-10-05"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Known_Cve | Sep 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ab3e498926ae6301f0a6910","created":"2026-09-23"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10451","tags":["vendor-advisory","issue-tracking"]},{"url":"https://www.d6fault.dev/blog/dlink-dap1360-os-command-injection","tags":["technical-description","exploit"]},{"url":"https://www.vulncheck.com/advisories/d-link-dap-1360-unauthenticated-rce-via-web-management-interface","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-84394","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84394","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-09-23","earliestUrl":"https://github.com/d6fault/CVE-2026-95675","repos":[{"name":"d6fault/CVE-2026-95675","url":"https://github.com/d6fault/CVE-2026-95675","stars":1,"created":"2026-09-23"}]},"first":{"date":"2026-09-23","source":"PoC-in-GitHub","url":"https://github.com/d6fault/CVE-2026-95675"},"provenance":"source"},"exploitRefs":["https://www.d6fault.dev/blog/dlink-dap1360-os-command-injection"],"flow":[],"timeline":[{"date":"2026-09-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-95675","provenance":"source"},{"date":"2026-09-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/d6fault/CVE-2026-95675","provenance":"source"},{"date":"2026-10-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-95675","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 26 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.25,"detail":"percentile 0.8127"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}