A critical command injection flaw in the Netcore NBR200V2 router's CGI diagnostic endpoint allows remote, unauthenticated attackers to execute arbitrary commands, and a public exploit already exists.
What Is It
CVE-2026-94097 is a command injection vulnerability in Netcore NBR200V2 firmware version 1.3.241127.071246. The flaw sits in /www/cgi-bin/network_tools, part of the device's CGI Diagnostic Endpoint component. Manipulation of the param, key, or val arguments causes command injection. The issue is classified under CWE-74 (improper neutralization of special elements) and CWE-77 (command injection).
Remote exploitation is possible, and the exploit has been publicly disclosed and may be utilized.
Why It Matters
VulDB, the CNA that published the record, assigns a CVSS v3.1 base score of 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every exploitability condition favors the attacker: network attack vector, low complexity, no privileges required, and no user interaction. Scope is marked Changed, meaning impact extends beyond the vulnerable component itself, with High confidentiality, integrity, and availability impact.
The same source's CVSS v4.0 assessment scores 9.3 (CRITICAL) with exploit maturity rated Proof-of-Concept, reflecting the public disclosure. Legacy CVSS v2 scoring is 10.0 with Complete impact across all three categories. NVD has not yet published its own analysis, so these scores are the CNA's rather than NVD-assigned.
A router-level command injection reachable without authentication would give an attacker code execution on a device that sits at the network perimeter. The available reporting documents the flaw in the device itself and does not describe downstream compromise of connected hosts, but the position is one from which traffic to and from those hosts passes.
What's Vulnerable
- Vendor: Netcore
- Product: NBR200V2
- Affected version: 1.3.241127.071246
- Component: CGI Diagnostic Endpoint
- Affected file:
/www/cgi-bin/network_tools - CPE:
cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*
Patch Status
No fix is available. According to the disclosure, the vendor was contacted early about this issue but did not respond in any way. The CVE record was published in September 2026 by VulDB ([email protected]) and remains in Received status in NVD, meaning NVD analysis is not yet complete.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no KEV-confirmed active exploitation or federally mandated remediation deadline at this time. That said, a public exploit against an unpatched, unresponsive-vendor device warrants treating exposed NBR200V2 units as compromisable; restricting external access to the device's web interface is the only mitigation supported by the available data.