Security1 hOctober 7, 2026, 11:20

CVE-2026-95675: Unauthenticated root RCE in D-Link DAP-1360

A critical OS command injection (CVSS 9.8) in the D-Link DAP-1360 web interface lets unauthenticated attackers run commands as root via the ipv4 ping parameter in apply.cgi. D-Link retired the device in August 2020 and will not issue a fix; 423 exposed instances were found online.

DEV Community

Open source

CVSS v3 score is 9.8; public exploit code and analysis are available
All DAP-1360 hardware revisions on firmware 6.14 and earlier are affected
No patch planned: vendor ended support for the product in August 2020
ZoomEye found 423 DAP-1360 instances exposed to the internet

#D-Link

CVE-2026-84411 in MikroTik RouterOS: unauthenticated HTTP request reaches root

Security

F5 BIG-IP APM CVE-2026-94127: unauthenticated RCE that hardening won't stop

Security

WordPress Click2Shell: unauthenticated RCE, fixed in 7.1.1

Security

CVE-2026-95675: Unauthenticated root RCE in D-Link DAP-1360

CVE-2026-84411 in MikroTik RouterOS: unauthenticated HTTP request reaches root

F5 BIG-IP APM CVE-2026-94127: unauthenticated RCE that hardening won't stop

WordPress Click2Shell: unauthenticated RCE, fixed in 7.1.1

LightLLM hit by two CVSS 9.8 unauthenticated RCE flaws