EUVD-2026-88083
GHSA-fgm2-rcgf-c7h9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote command injection over HTTP (AV:N/AC:L/PR:N/UI:N) yields full device compromise; scope unchanged as the vulnerable component and impacted component are the same device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the NBR200V2 Web Management Interface and the ability to send an HTTP request to /www/cgi-bin/network_tools; the eval function processes the attacker-controlled QUERY_STRING with no authentication (PR:N) and no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All primary signals point to a genuinely high-severity flaw: CWE-78 OS command injection reachable over the network with no authentication and no user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, full VC:H/VI:H/VA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis: Netcore was contacted before disclosure and did not respond, and neither the VulDB records (https://vuldb.com/vuln/410871, https://vuldb.com/cve/CVE-2026-101001) nor the public PoC reference a fixed firmware build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Netcore NBR200V2 devices and identify any running firmware 1.3.241127.071246; immediately remove internet-facing access to their web management interface, disable remote management where not strictly required, and restrict administrative access to trusted internal networks via firewall or ACL rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker c
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today