Description
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-21
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the /www/cgi-bin/upgrade CGI on Netcore NBR200V2 allows an unauthenticated user to manipulate the QUERY_STRING parameter so that arbitrary shell commands are executed on the device. The vulnerability is a classic command injection, giving attackers full control over the underlying operating system, thus compromising confidentiality, integrity, and availability of the device and any associated network services.

Affected Systems

The vulnerability was identified in Netcore NBR200V2 firmware version 1.3.241127.071246. The attack vector relies on interacting with the Firmware Upgrade CGI endpoint, which is typically exposed for remote firmware management.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical impact level. The EPSS score is not available, yet a publicly available exploit exists, increasing the likelihood of real‑world attacks. The vulnerability is not yet listed in CISA’s KEV catalog, but its high severity and remote nature mean that it could be actively exploited by malicious actors.

Generated by OpenCVE AI on September 21, 2026 at 01:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the device firmware to a version that removes the CGI endpoint or patches the QUERY_STRING handling; check Netcore for an official firmware release covering 1.3.241127.071246.
  • If a patch is not yet available, block or disable access to the /www/cgi-bin/upgrade endpoint via network filtering or firewall rules to prevent remote exploitation.
  • Limit management interface access to a narrow set of trusted IP addresses or VPN tunnels so that only authorized personnel can reach the upgrade CGI, thereby reducing the attack surface.

Generated by OpenCVE AI on September 21, 2026 at 01:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
First Time appeared Netcore
Netcore nbr200v2
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nbr200v2
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nbr200v2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-21T00:00:10.155Z

Reserved: 2026-09-20T09:19:05.916Z

Link: CVE-2026-94098

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T01:16:29.800

Modified: 2026-09-21T01:16:29.800

Link: CVE-2026-94098

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')