Netcore NBR200V2 Command Injection and Buffer Overflow Flaws

Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) lets remote attackers execute arbitrary shell commands on the device through the /www/cgi-bin/network_tools CGI diagnostic endpoint by supplying crafted param, key, or val arguments. The vendor CVSS 4.0 vector (9.3) rates this remote, unauthenticated, and requiring no user interaction, and publicly available exploit code exists; the vendor was contacted early but never responded, so no fix is available. Any deployment that exposes the router's web management interface to an untrusted network is at risk of full device compromise.

Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.

Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.

Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.

Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.