What CVE-2026-95675 Teaches About End-of-Life Wireless Hardware

Setting

CVE-2026-95675 is a critical, unauthenticated command injection in the D-Link DAP-1360, a wireless access point and range extender that the vendor retired in August 2020. The flaw grants root-level command execution through the web management interface. There is no fix and none will be produced.

The technical detail

The web server binary behind apply.cgi handles network diagnostics by reading the ipv4 ping parameter and formatting it into a system ping command. The composed string reaches the command interpreter without sanitisation. Shell metacharacters in the parameter therefore become commands, executed as root, with no authentication required. Firmware 6.14 and earlier is affected across all hardware revisions.

Why wireless hardware ages badly

Wireless access points and range extenders are often the last devices to be refreshed. They are cheap, they are physically distributed, and they keep working long after they leave support. That makes them ideal long-term residents of a network and poor candidates for the kind of continuous patching that servers receive. By the time a critical flaw appears, the installed base is undocumented and the vendor has moved on.

Exposure

A ZoomEye search for the product fingerprint app="D-Link DAP-1360" returned 423 matching instances worldwide at the time of writing. A CVE-scoped query, vul.cve="CVE-2026-95675", returned no indexed assets, which is expected for a freshly assigned identifier. The product fingerprint therefore gives the more useful exposure estimate, and it only counts assets that still answer with a recognisable DAP-1360 signature; devices hidden behind firewalls or with a modified management banner are not represented.

Practical lessons

Track end-of-life dates as part of procurement, not as an afterthought. Maintain inventory coverage for small network hardware, because the DAP-1360 lesson is that these devices accumulate invisibly. Assume that retired hardware will eventually receive a public exploit, and plan replacement on that basis rather than waiting for a trigger.

Immediate actions

Replace affected units. In the interim, isolate their management interfaces and rotate any credentials stored on them.

References

• D-Link DAP-1360 vulnerability details and PoC
• D-Link product security advisory for the retired DAP-1360 family