Nap930
Monthly
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.