Which versions of Netcore NBR200V2 are affected by CVE-2026-94098?

Netcore NBR200V2 routers running firmware 1.3.241127.071246 contain a high-severity command injection flaw that allows an attacker who can reach the device's administrative interface to run arbitrary…

Is there a public PoC exploit available for CVE-2026-94098?

Yes, a public proof-of-concept exploit is available for CVE-2026-94098. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-94098?

Within 24 hours, inventory every Netcore NBR200V2 running firmware 1.3.241127.071246, determine whether remote management or other WAN-side administrative access is enabled, and disable it immediately, since the flaw is reachable through the /www/cgi-bin/upgrade CGI endpoint by anyone who can reach the admin interface, which is typically LAN-only unless remote management is enabled; simultaneously rotate administrative credentials on affected units and review device logs for requests to /cgi-bin/upgrade containing shell metacharacters in the query string. Within 7 days, relocate affected routers into a dedicated management VLAN with firewall rules permitting administrative access only from a small set of trusted hosts, block inbound access to the device web interface from untrusted networks, enable outbound monitoring for signs of compromise, open a formal support case with Netcore, and identify a supported replacement model. Within 30 days, replace or decommission the affected NBR200V2 units in favor of a vendor-supported platform, given that no vendor-released patch is identified at time of analysis and the vendor did not respond to disclosure; where replacement cannot be completed, retain the 7-day segmentation and monitoring controls and re-assess monthly.

Netcore NBR200V2 CVE-2026-94098

Q: What is the CVSS score of CVE-2026-94098?

CVE-2026-94098 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-83810 HIGH

Command Injection (CWE-77)

2026-09-21 VulDB

GHSA-4w3j-cmwq-6m3q

Command Injection Netcore Nbr200V2

8.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable admin firmware-upgrade CGI requires authenticated high-privilege access (PR:H); injected commands run as root on the device itself (S:U, C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 21, 2026 - 11:22 vuln.today

Metadata Corrected

Sep 21, 2026 - 01:40 vuln.today

tag: Netcore added

Analysis Updated

Sep 21, 2026 - 01:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 21, 2026 - 01:22 vuln.today

cvss_changed

Severity Changed

Sep 21, 2026 - 01:22 NVD

CRITICAL HIGH

CVSS changed

Sep 21, 2026 - 01:22 NVD

9.4 (CRITICAL) 8.5 (HIGH)

Analysis Generated

Sep 21, 2026 - 00:57 vuln.today

CVE Published

Sep 21, 2026 - 00:00 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires reaching the /www/cgi-bin/upgrade Firmware Upgrade CGI endpoint, which is an administrative function - the CVSS PR:H metric indicates high-privilege (authenticated admin) access is needed, so a valid session or admin credentials (or default/weak passwords) are a prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine command-injection-to-RCE flaw in the Netcore NBR200V2 router's firmware-upgrade CGI, but the real-world priority is moderate rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Netcore NBR200V2 running firmware 1.3.241127.071246, determine whether remote management or other WAN-side administrative access is enabled, and disable it immediately, since the flaw is reachable through the /www/cgi-bin/upgrade CGI endpoint by anyone who can reach the admin interface, which is typically LAN-only unless remote management is enabled; simultaneously rotate administrative credentials on affected units and review device logs for requests to /cgi-bin/upgrade containing shell metacharacters in the query string. …

Threat intelligence, references, and detailed analysis are available after sign-in.