CVE-2026-95675

Summary

The flaw is an unauthenticated remote code execution vulnerability in D-Link DAP-1360 firmware versions 6.14 and earlier, allowing attackers to execute arbitrary commands as root via crafted web requests. This vulnerability is critical as it enables full device compromise and potential network pivoting.

Exploitability

Exploitation is relatively straightforward as it requires no valid credentials and can be performed by sending crafted requests to the device's web management interface. Precondition is access to the device's web interface.

Blast radius

If exploited, the vulnerability could lead to full device compromise, persistent configuration modification, and use of the device as a pivot point into the local network, posing a significant risk to the network's security.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 6.15 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.