Description
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 9.4 Critical
EPSS: 1.7% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in Netcore NBR200V2 1.3.241127.071246 in the Tools Ping Handler located in /usr/bin/network_tools. Manipulating the url argument allows an attacker to inject arbitrary operating‑system commands, leading to remote command execution with full control over the device. The vulnerability is a classic OS command injection (CWE-78) and can be used to compromise confidentiality, integrity and availability.

Affected Systems

Vendor Netcore, product NBR200V2. The affected firmware version is 1.3.241127.071246. No other versions were mentioned in the advisory.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical level of severity. The EPSS score is 0.0167%, and the vulnerability is not listed inV catalog. Based on the description, it is inferred that the attack can be initiated remotely without authentication, and a public exploit has already been released, which increases the likelihood that attackers will target this flaw.

Generated by OpenCVE AI on September 28, 2026 at 15:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued firmware patch that fixes the URL handling in the ping tool or upgrade to a later, patched NBR200V2 release
  • Restrict external access to the /usr/bin/network_tools endpoint using firewall rules or network segmentation so that the ping command cannot be accessed remotely
  • If an immediate patch is not available, enforce input sanitization by configuring the system to allow only safe characters in the url parameter or selectively disabling the ping functionality

Generated by OpenCVE AI on September 28, 2026 at 15:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NBR200V2 Tools Ping network_tools system os command injection
First Time appeared Netcore
Netcore nbr200v2
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nbr200v2
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nbr200v2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T12:49:23.377Z

Reserved: 2026-09-27T10:24:58.440Z

Link: CVE-2026-101002

cve-icon Vulnrichment

Updated: 2026-09-28T12:49:18.923Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T06:16:29.783

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-101002

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T16:00:03Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')