Which versions of Power 15Ax are affected by CVE-2026-4840?

Netcore Power 15AX routers contain a critical remote command execution vulnerability affecting authenticated users, with public exploit code now available.

Is there a public PoC exploit available for CVE-2026-4840?

Yes, a public proof-of-concept exploit is available for CVE-2026-4840. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-4840?

Within 24 hours: Identify and inventory all Netcore Power 15AX routers in production (firmware ≤3.0.0.6938) and restrict network access to the /bin/netis.cgi endpoint. Within 7 days: Implement WAF rules to block suspicious IpAddr parameters and disable the Diagnostic Tool Interface if operationally feasible. Within 30 days: Contact Netcore for security updates, evaluate device replacement timelines, or migrate critical functions to alternative networking equipment pending vendor patch availability.

Power 15Ax CVE-2026-4840

Q: What is the CVSS score of CVE-2026-4840?

CVE-2026-4840 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-16108 HIGH

OS Command Injection (CWE-78)

2026-03-26 VulDB

Command Injection Power 15Ax

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16108

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 04:05 nvd

HIGH 7.4

DescriptionCVE.org

A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A critical OS command injection vulnerability exists in the Diagnostic Tool Interface of Netcore Power 15AX routers up to firmware version 3.0.0.6938. An authenticated attacker with low-level privileges can remotely execute arbitrary operating system commands by manipulating the IpAddr parameter in the setTools function of /bin/netis.cgi. A public proof-of-concept exploit has been released on GitHub, significantly increasing the risk of active exploitation, though the vendor has not responded to disclosure attempts.

Technical ContextAI

This vulnerability (CWE-78: OS Command Injection) affects the Netcore Power 15AX router (cpe:2.3:a:netcore:power_15ax:*:*:*:*:*:*:*:*) firmware versions up to 3.0.0.6938. The flaw resides in the setTools function within the /bin/netis.cgi CGI script, which is part of the router's diagnostic tool interface accessible via the web management panel. OS command injection occurs when user-supplied input (the IpAddr parameter, typically used for network diagnostic commands like ping or traceroute) is not properly sanitized before being passed to system shell commands. This allows attackers to break out of the intended command context and execute arbitrary shell commands with the privileges of the web server process, potentially gaining full control of the device.

RemediationAI

As the vendor has not responded to disclosure and no official patch appears available (RL:X), immediate mitigation focuses on compensating controls. Disable remote administrative access to the router's web interface from untrusted networks and restrict management access to trusted IP addresses only via firewall rules or the router's access control lists. If diagnostic tools are not required, disable or restrict access to the /bin/netis.cgi interface through custom firmware modifications if possible. Consider replacing affected devices with alternative router models from responsive vendors if Netcore continues to remain silent on this vulnerability. Organizations should monitor https://vuldb.com/?id.353146 and vendor channels for any future patch announcements, though given the lack of vendor response, retirement of these devices may be the most prudent long-term solution.