Nbr200V2
Monthly
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.