A critical command injection flaw in the Netcore NBR200V2 router's traceroute diagnostic feature allows remote attackers with low privileges to execute arbitrary commands, with a public exploit available and no vendor response to the disclosure.
What Is It
CVE-2026-94095 is a command injection vulnerability (CWE-77, under CWE-74) in Netcore NBR200V2 firmware version 1.3.241127.071246. The flaw lives in an unknown function of the file /usr/bin/network_tools, part of the device's Traceroute Diagnostic Feature. Manipulation of the url argument leads to command injection, and the attack can be initiated remotely.
The vulnerability carries a base score of 9.9 (CRITICAL) under CVSS 3.1, with the metrics AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. Note that the published record renders this string with a CVSS:4.0/ prefix even though the metrics themselves are CVSS 3.1 metrics (CVSS 4.0 has no S: scope metric), so the prefix appears to be a labeling error in the source data. Separately, the CVSS 4.0 assessment scores the issue 8.6 (HIGH) and flags exploit maturity as Proof-of-Concept.
Why It Matters
The exploit has been publicly disclosed and may be used. Scope is rated "changed," which indicates that successful exploitation is expected to reach beyond the vulnerable component itself; consistent with command execution on the underlying device OS, though the available material does not detail the resulting execution context. Because the affected component is a network diagnostic feature reachable remotely, the scoring suggests an attacker holding only low-level privileges on the device could gain a high degree of control over it.
Compounding the risk: the vendor was contacted early about this disclosure but did not respond in any way.
What's Vulnerable
- Vendor: Netcore
- Product: NBR200V2
- Affected version: 1.3.241127.071246
- Component: Traceroute Diagnostic Feature (
/usr/bin/network_tools) - Affected parameter:
url
No CISA KEV entry exists for this CVE, so there is no confirmation of active in-the-wild exploitation at this time.
Patch Status
No patch or fix is identified in the available source material. The vendor did not respond to the disclosure attempt, and no remediation guidance or required action has been published. NVD currently lists the record as Received status, meaning it has not yet been through NVD analysis and its metadata may change.