Netcore NBR200V2 CVE-2026-94097

Requires network reachability to the Netcore NBR200V2 (firmware 1.3.241127.071246) HTTP management interface exposing the /www/cgi-bin/network_tools CGI Diagnostic Endpoint; exploitation is triggered by injecting shell metacharacters into the param/key/val arguments of that endpoint. Per the vendor CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed, but note the sibling CVE on the same network_tools binary was scored as authenticated (PR:L) - the real auth gate on the web panel should be verified. Limiting factors: exploitation depends on the management interface being reachable to the attacker (typically LAN-side; WAN exposure is not stated), and the device is a single specific firmware build of a niche consumer router, so the exposed population is small. No fix is available because the vendor did not respond.

This scores high (vendor CVSS 4.0 9.3) and the signals mostly align for genuine priority IF the device is network-reachable: the vector is AV:N/AC:L/PR:N/UI:N (remote, unauthenticated, no user interaction) against a router CGI endpoint, and command injection typically yields full device control. SSVC 'Exploitation' is E:P (proof-of-concept) - publicly available exploit code exists (VulDB submission + a Notion write-up), but this is NOT confirmed active exploitation: there is no CISA KEV listing and no EPSS score in the provided data. I dispute the vendor's subsequent-system metrics (SC:H/SI:H/SA:H) - command injection here runs on the router itself with no scope change to a separate system, so the subsequent-system impacts should be N; my independent 3.1 assessment is ~9.8 (full compromise of the target). Conflicting signal to verify: the sibling CVE (CVE-2026-94095, same network_tools binary on the same firmware) was scored PR:L (authenticated), whereas this one is PR:N - the true authentication requirement of the /www/cgi-bin/network_tools endpoint should be confirmed with the firmware, as router diagnostic CGIs are frequently behind a login. Net: a real, high-impact flaw on an obscure product; prioritize for anyone running this exact router, but real-world exploitation is likely targeted/opportunistic scanning rather than mass-weaponized given the low deployment footprint and absence of KEV/EPSS.

An attacker reachable to the router's web/management interface sends a crafted request to /www/cgi-bin/network_tools with shell metacharacters injected into the param/key/val arguments of the diagnostic function, causing the CGI to execute arbitrary OS commands on the device. Public exploit material has been disclosed (VulDB submission 892990 and a Notion write-up), and the CVSS vector indicates no authentication or user interaction is required, so exploitation is straightforward against an exposed device.