Description
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-21
Score: 9.4 Critical
EPSS: 2.4% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the /www/cgi-bin/upgrade CGI on Netcore NBR200V2 allows manipulation of the QUERY_STRING parameter so that arbitrary shell commands are executed on the device. Based on the description, it is inferred that the attacker does not need authentication, which could give attackers full control over the underlying operating system, thus compromising confidentiality, integrity, and availability of the device and any associated network services.

Affected Systems

The vulnerability was identified in Netcore NBR200V2 firmware version 1.3.241127.071246. The likely attack vector involves remote interaction with the Firmware Upgrade CGI endpoint, which is typically exposed for remote firmware management.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical impact level. The EPSS score is 2%, yet a publicly available exploit exists, increasing the likelihood of real‑world attacks. The vulnerability is not yet listed in CISA’s KEV catalog, but its high severity and remote nature mean that it could be actively exploited by malicious actors.

Generated by OpenCVE AI on September 26, 2026 at 05:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to a version that removes the CGI endpoint or patches the QUERY_STRING handling; check Netcore for an official firmware release covering 1.3.241127.071246.
  • If a patch is not yet available, block or disable access to the /www/cgi-bin/upgrade endpoint via network filtering or firewall rules to prevent remote exploitation.
  • Limit management interface access to a narrow set of trusted IP addresses or VPN tunnels so that only authorized personnel can reach the upgrade CGI, thereby reducing the attack surface.

Generated by OpenCVE AI on September 26, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
First Time appeared Netcore
Netcore nbr200v2
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nbr200v2
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nbr200v2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-21T16:00:36.531Z

Reserved: 2026-09-20T09:19:05.916Z

Link: CVE-2026-94098

cve-icon Vulnrichment

Updated: 2026-09-21T16:00:31.927Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T01:16:29.800

Modified: 2026-09-21T17:19:19.577

Link: CVE-2026-94098

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T05:45:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')