This vulnerability enables an attacker to inject and execute arbitrary operating system commands via the eval function in the Web Management Interface’s network_tools CGI script. By manipulating the QUERY_STRING parameter, a remote actor can run arbitrary shell commands with the privileges of the web server process. The impact is full system compromise of the affected router, including integrity, confidentiality, and availability breaches. The weakness is an Classic Command Injection flaw as indicated by CWE-77 and CWE-78.

The flaw exists in Netcore NBR200V2 firmware version 1.3.241127.071246. Only this version of the Netcore NBR200V2 router is reported to be affected; vendors and firmware distributions must confirm whether other releases contain the same issue.

With a CVSS score of 10 the severity is critical. The EPSS score is 3%, indicating a low but non‑negligible probability of exploitation, yet the publicly available exploit code suggests the likelihood of use by threat actors remains high. The attack vector is remote, as the web interface is reachable over the network. The vendor did not publish a fix or acknowledge the issue at the time of disclosure, so the risk remains unless mitigated by network controls or firmware updates.