Description
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 10 Critical
EPSS: 2.0% Low
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

A remote attacker can exploit the eval function in the Netcore NAP930 router's Network Tools CGI by manipulating the 'sid' argument. This flaw allows the construction of operating‑system commands that are executed with the privileges of the web server, giving the attacker full control over the device. The vulnerability is classified as OS command injection (CWE‑78) and equivalent to a generic command injection (CWE‑77). The high severity score of 10 reflects the potential for complete compromise of confidentiality, integrity, and availability if the flaw is abused.

Affected Systems

The flaw affects the Netcore NAP930 router running firmware version 0.1.241010.141410. Only this exact build is confirmed to contain the vulnerable /www/cgi-bin/network_tools script. No other Netcore devices or firmware revisions are listed. The vendor was contacted for a fix but did not provide a timely response.

Risk and Exploitability

The CVSS v3.1 base score of 10 reflects the severity of the vulnerability. The EPSS score of 2% indicates a low probability that the vulnerability is being actively exploited. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly documented and can be performed remotely without authentication by sending a crafted request to the /www/cgi-bin/network_tools interface. No reports of exploitation are mentioned in the data provided.

Generated by OpenCVE AI on September 30, 2026 at 04:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the NAP930 firmware to the latest version that contains a fix for the command injection issue or apply the vendor’s official patch.
  • If a firmware update is not available immediately, block or delete the /www/cgi-bin/network_tools CGI or otherwise disable the exposed sid parameter through a local firewall or ACL.
  • Limit external exposure of the router by placing it behind a trusted network perimeter, restricting management access to internal subnets or a VPN, and applying strict access control lists.

Generated by OpenCVE AI on September 30, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NAP930 Network Tools CGI network_tools eval os command injection
First Time appeared Netcore
Netcore nap930
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:netcore:nap930:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nap930
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nap930
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T17:21:09.679Z

Reserved: 2026-09-28T18:37:14.876Z

Link: CVE-2026-102240

cve-icon Vulnrichment

Updated: 2026-09-29T17:21:04.175Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T02:16:55.153

Modified: 2026-09-29T18:57:24.350

Link: CVE-2026-102240

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:15:08Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')