A publicly disclosed command injection flaw in the Netcore NBR200V2 router's firmware upgrade CGI endpoint allows remote attackers to execute arbitrary commands, with a proof-of-concept reported to be public and no vendor response recorded in the available data.
What Is It
CVE-2026-94098 is a command injection vulnerability (CWE-74, CWE-77) in Netcore NBR200V2 firmware version 1.3.241127.071246. The flaw resides in unknown code within the file /www/cgi-bin/upgrade, part of the Firmware Upgrade CGI Endpoint component. Manipulation of the QUERY_STRING argument leads to command injection, and the attack can be executed remotely.
NVD assigns a base score of 9.1 (CRITICAL) against the metrics AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. Note that the published record is internally inconsistent here: the vector string carries a CVSS:4.0 prefix, but the metrics it contains (including the scope metric S:C) are CVSS 3.1 metrics, and 9.1 is the CVSS 3.1 score for that combination. Read the severity as CVSS 3.1 until NVD completes analysis. Exploitation does require high privileges. A CVSS 4.0 secondary score of 8.5 (HIGH) rates exploit maturity as Proof-of-Concept.
Why It Matters
According to the advisory, the exploit is publicly available and "might be used." Because the vulnerable code sits in a CGI endpoint on a consumer/SOHO router, successful injection would mean command execution on the device itself, the network boundary, and the changed scope in the CVSS 3.1 metrics indicates impact beyond the vulnerable component. The high-privileges requirement (PR:H) tempers that somewhat: an attacker needs existing privileged access to the device to reach the endpoint.
The advisory states that the vendor was contacted early about this disclosure and did not respond. That reported silence, combined with a public proof-of-concept, leaves affected devices without a coordinated remediation path.
No CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-94098 appears in the data reviewed for this brief, and there is no confirmation of active in-the-wild exploitation in that data. Defenders should verify current KEV status directly against CISA's catalog rather than relying on this snapshot.
What's Vulnerable
- Vendor: Netcore
- Product: NBR200V2
- Affected version: 1.3.241127.071246
- Component: Firmware Upgrade CGI Endpoint (
/www/cgi-bin/upgrade) - CPE:
cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*
Patch Status
No patch, fixed version, or vendor advisory is identified in the available data, and the advisory reports no vendor response to the disclosure attempt. Because no KEV entry for this CVE appears in the reviewed data, no federal required action or remediation deadline is known to apply; confirm against CISA directly before relying on that for compliance purposes. The record carries NVD vulnerability status "Received," meaning analysis is not yet complete and the scoring details above may change.