Description
A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-26
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the setTools function of the /bin/netis.cgi diagnostic tool on Netcore Power 15AX devices. Manipulating the IpAddr argument allows an attacker to inject arbitrary operating‑system commands, resulting in remote command execution. This weakness corresponds to CWE‑77 (OS Command Injection) and CWE‑78 (Improper Neutralization of Special Elements used in an OS Command). The impact is that a remote attacker could gain full control over the device, compromising confidentiality, integrity, and availability.

Affected Systems

Affected firmware versions of Netcore Power 15AX are those up to and including 3.0.0.6938. Any device running these firmware images is vulnerable. The vulnerability is limited to the Diagnostic Tool Interface component; other product components are not affected.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. Although EPSS data is not provided, the existence of a publicly released exploit and the vendor’s lack of a timely response increase the risk of exploitation. Remote exploitation is possible over the network via the exposed Diagnostic Tool Interface. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on March 26, 2026 at 05:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire and install the latest firmware release that addresses the command injection flaw.
  • If a patch is not yet available, restrict external network access to the /bin/netis.cgi endpoint or block the Diagnostic Tool Interface entirely.
  • As an additional precaution, disable or remove the Diagnostic Tool component if it is not essential to operations.

Generated by OpenCVE AI on March 26, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Netcore
Netcore power 15ax
Vendors & Products Netcore
Netcore power 15ax

Thu, 26 Mar 2026 04:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Netcore Power 15ax
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T14:56:13.210Z

Reserved: 2026-03-25T14:39:11.689Z

Link: CVE-2026-4840

cve-icon Vulnrichment

Updated: 2026-03-30T12:58:04.921Z

cve-icon NVD

Status : Deferred

Published: 2026-03-26T05:16:40.840

Modified: 2026-04-24T16:35:20.070

Link: CVE-2026-4840

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:08:35Z

Weaknesses