EUVD-2026-83810
GHSA-4w3j-cmwq-6m3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin firmware-upgrade CGI requires authenticated high-privilege access (PR:H); injected commands run as root on the device itself (S:U, C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching the /www/cgi-bin/upgrade Firmware Upgrade CGI endpoint, which is an administrative function - the CVSS PR:H metric indicates high-privilege (authenticated admin) access is needed, so a valid session or admin credentials (or default/weak passwords) are a prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine command-injection-to-RCE flaw in the Netcore NBR200V2 router's firmware-upgrade CGI, but the real-world priority is moderate rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Netcore NBR200V2 running firmware 1.3.241127.071246, determine whether remote management or other WAN-side administrative access is enabled, and disable it immediately, since the flaw is reachable through the /www/cgi-bin/upgrade CGI endpoint by anyone who can reach the admin interface, which is typically LAN-only unless remote management is enabled; simultaneously rotate administrative credentials on affected units and review device logs for requests to /cgi-bin/upgrade containing shell metacharacters in the query string. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can r
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privile
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-pri
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged atta
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege c
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today