CVE-2026-95675: D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the local network.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
D-Link DAP-1360 devices running firmware 6.14 or earlier are affected when their web management interface is reachable by a remote attacker. No credentials or user interaction are required.
What level of access does successful exploitation provide?
An attacker can execute arbitrary commands as root, fully compromising the device. They can persistently alter its configuration and potentially use the device to pivot into the local network.
How can I determine whether a device is affected?
Identify D-Link DAP-1360 devices and verify their installed firmware version. Versions 6.14 and earlier are affected; the provided information does not specify a fixed version or workaround.