EUVD-2026-80034
GHSA-w53v-q6c8-r55c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.
AnalysisAI
Authenticated attackers can inject crafted arguments into the tcpdump launch routines exposed by the Nettools feature of Netcore NR255-V firmware 1.5.130703, causing the device to execute attacker-manipulated system commands as part of the tcpdump invocation. The flaw affects multiple CGI/handler components — ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default and ntools_proc — and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:L/UI:N) with high confidentiality, integrity and availability impact confined to the device itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today