CVE-2026-102240

Netcore NAP930 Network Tools CGI network_tools eval os command injection

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed
Description
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A remote attacker can exploit the eval function in the Netcore NAP930 router's Network Tools CGI by manipulating the 'sid' argument. This flaw allows the construction of operating‑system commands that are executed with the privileges of the web server, giving the attacker full control over the device. The vulnerability is classified as OS command injection (CWE‑78) and equivalent to a generic command injection (CWE‑77). The high severity score of 10 reflects the potential for complete compromise of confidentiality, integrity, and availability if the flaw is abused.

Affected Systems

The flaw affects the Netcore NAP930 router running firmware version 0.1.241010.141410. Only this exact build is confirmed to contain the vulnerable /www/cgi-bin/network_tools script. No other Netcore devices or firmware revisions are listed. The vendor was contacted for a fix but did not provide a timely response.

Risk and Exploitability

The CVSS v3.1 base score of 10 reflects the severity of the vulnerability. The EPSS score of 2% indicates a low probability that the vulnerability is being actively exploited. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly documented and can be performed remotely without authentication by sending a crafted request to the /www/cgi-bin/network_tools interface. No reports of exploitation are mentioned in the data provided.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the NAP930 firmware to the latest version that contains a fix for the command injection issue or apply the vendor’s official patch.
  • If a firmware update is not available immediately, block or delete the /www/cgi-bin/network_tools CGI or otherwise disable the exposed sid parameter through a local firewall or ACL.
  • Limit external exposure of the router by placing it behind a trusted network perimeter, restricting management access to internal subnets or a VPN, and applying strict access control lists.

Generated by OpenCVE AI on September 30, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NAP930 Network Tools CGI network_tools eval os command injection
First Time appeared Netcore
Netcore nap930
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:netcore:nap930:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nap930
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 5:21 PM
Reserved
Sep 28, 2026, 6:37 PM

View source JSON

Updated
Sep 29, 2026, 5:21 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 2:16 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 30, 2026, 4:15 AM

JSON