EUVD-2026-85858
GHSA-w4g8-c6r8-947v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN/adjacent network access
-
DeliveryAuthenticate to web management UI
-
ExploitUpload crafted diagnostic script
-
ExecutionBypass weak authz/input validation
-
PersistExecute script as root
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network access adjacent to the device - the router's web management interface, typically reachable only from the LAN/local segment (AV:A), not the public internet by default; and (2) authenticated access to that interface at low privilege (PR:L), e.g. via default, weak, or stolen credentials. The specific trigger is the diagnostic script import functionality of the web management UI, where insufficient authorization and input validation let an uploaded crafted script run as root. No user interaction is needed (UI:N). Limiting factors: valid credentials and adjacent-network reachability are both prerequisites, which meaningfully reduce exposure versus a remote unauthenticated flaw. |
| Impact | This is a genuinely serious flaw where it applies, but its real-world priority is constrained by product footprint and access requirements. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes an authenticated, low-complexity attack over an adjacent network yielding full compromise (root) of the device - consistent with the description of arbitrary OS command execution via diagnostic script import. Impact is unambiguously high (root = complete device takeover), but two signals temper urgency: the attacker must already be authenticated to the web management interface (PR:L), and the attack vector is adjacent (AV:A), not internet-wide network reachable - meaning exploitation typically requires LAN/local-segment access to the router's admin UI plus valid credentials. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code identified in the provided data, so there is no evidence of active or automated exploitation. No SSVC decision data was provided. Bottom line: high technical severity but access-gated and, given the niche product, likely of targeted rather than widespread concern - no public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker with valid (even low-privilege) credentials to the HG323RW web management interface - obtained via default/weak passwords, phishing, or LAN foothold - navigates to the diagnostic script import function and uploads a specially crafted script. Because authorization and input validation are insufficient, the script executes with root privileges, giving the attacker full command execution and complete device compromise. No public proof-of-concept exploit was identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Authenticated root-level command execution in the Netlink ICT HG323RW router lets an attacker who already holds valid low-privilege credentials on the adjacent network upload a crafted diagnostic script through the web management interface, which the device then executes with root privileges and is fully compromised as a result. The prerequisites matter: the attacker must be able to reach the router's web management interface (normally confined to the LAN/local segment rather than the public internet) and must supply valid credentials, so real-world exposure is narrower than the raw severity suggests. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so prioritization should be driven by asset footprint and the presence of these devices on untrusted or shared network segments rather than by active exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no fixed firmware version is published in the CPE data or the CERT-In advisory (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0473), so remediation must currently rely on compensating controls while the vendor is contacted for a firmware update. The highest-value control is to eliminate the authenticated and adjacency prerequisites: immediately replace any default or weak administrative credentials on the HG323RW, restrict the web management interface to a trusted management VLAN or an explicit allowlist of administrative hosts, and confirm that WAN-side or remote-administration access to the UI is disabled - the trade-off being that administrators lose convenient remote reach to the router. Where the firmware permits it, disable or block the diagnostic script import function entirely, since that feature is the specific trigger and disabling it removes the attack path at the cost of losing vendor-support diagnostics. Place the device behind a firewall rule that blocks inbound access to the management port from user or guest segments, and monitor web-management logs for unexpected script uploads or POSTs to diagnostic endpoints as a detection measure, accepting that logging alone does not prevent exploitation once credentials are held. If the router's firmware cannot be hardened to these standards and it sits on a shared or semi-trusted segment, plan for replacement with a vendor that ships fixed firmware.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is rooted in a missing-authorization weakness (CWE-862) combined with inadequate input validation in the diagnostic script import feature of the HG323RW's embedded web management interface - a common pattern in consumer/SOHO-class router firmware where administrative functions are gated by the web session but not by per-function privilege checks or by sanitization of uploaded content. Because diagnostic import handlers on these devices typically shell out to system utilities to run the imported script, the uploaded file is executed by the underlying Linux-based firmware under the root account, collapsing authorization failure and input-validation failure into direct operating-system command execution. The vendor-supplied CPE cpe:2.3:a:netlink_ict_pvt_ltd:netlink_ict_hg323rw_router:*:*:*:*:*:*:*:* treats the product as affected across all tracked versions, and the assessment vector (AV:A/PR:L/UI:N) confirms the attack path requires adjacency plus a low-privileged authenticated session rather than remote unauthenticated access from the internet. CERT-In published the underlying report as advisory CIVN-2026-0473.
Know when Netlink Ict Hg323Rw Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Adjacent web-management interface (AV:A) reachable by an authenticated low-privilege user (PR:L); script executes as root yielding full C/I/A impact with no scope change (SC/SI/SA:N).
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
DescriptionCVE.org
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the web management interface.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary operating system commands with root privileges resulting in complete compromise of the affected device.
Executive ViewAI
The Netlink ICT HG323RW router contains a high-severity flaw (CVE-2026-96515) that allows an attacker holding valid low-privilege credentials on the local network to upload a diagnostic script through the web management interface, which the device executes with root privileges - resulting in full compromise of the device. Exposure is bounded by two prerequisites that limit real-world risk: the attacker must already possess valid credentials and must be able to reach the web management interface, which is normally confined to the LAN rather than the public internet. Leadership should treat this as a network-integrity and segmentation issue rather than an emergency, prioritizing units deployed on shared, untrusted, or flat network segments; no public exploit code and no vendor patch are identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface access to a dedicated management VLAN with source-address allowlists; block management access from untrusted, guest, or public networks; disable remote/WAN administration; enforce unique strong credentials and remove unnecessary low-privilege accounts (a valid credential is a prerequisite for exploitation); monitor device logs for anomalous diagnostic script uploads; and isolate or replace affected units until vendor firmware is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB