EUVD-2026-83802
GHSA-63qx-qw7q-xchq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable diagnostic with low-privilege auth (PR:L) yields shell command execution as root on the device, giving full C/I/A impact; scope unchanged as impact stays on the same system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the NBR200V2 web management interface and low-privilege authentication (CVSS PR:L), plus the Traceroute Diagnostic Feature being reachable to the attacker's account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with VC/VI/VA:H) scores 8.6, and the flaw is genuine command injection (CWE-77) in the router's traceroute diagnostic, which on an embedded Linux device typically yields code execution as root - a high technical impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis: Netcore was contacted about the disclosure but did not respond, and none of the supplied references point to a fixed firmware release, so administrators should assume the flaw is unpatched on firmware 1.3.241127.071246. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict access to the NBR200V2 web management interface to trusted administrative networks or VPN, disable remote management, change default credentials, and review logs for traceroute command injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authentic
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can r
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privile
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-pri
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged atta
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege c
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today