Netcore
Monthly
Integer overflow in the msg_aes_dec function of the /usr/bin/auto_ac binary on Netcore NBR100V2 routers (firmware 1.3.240614.030928) allows remote, unauthenticated attackers to cause a denial of service. The CVSS 4.0 vector scores 7.7, but the impact is availability-only (VC:N, VI:N, VA:H) per the assessed CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no code execution or data disclosure is confirmed despite the 'Information Disclosure' tag. A public exploit reference exists and the vendor did not respond to the disclosure; no vendor patch or fixed version is identified, and the CISA KEV catalog does not list this CVE.
An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.
Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.
Remote code execution in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router firmware v1.3.241114.024540 and earlier is caused by OS command injection in the www/cgi-bin/upgrade handler, allowing a network attacker to run arbitrary commands through the router's HTTP management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so unauthenticated exploitation is possible when that endpoint is reachable. No CISA KEV confirmation was provided and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), indicating low predicted exploitation activity despite the critical severity score.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.
Unauthenticated file write in the Boa-derived /bin/boa web server on Netcore NR256CN routers (firmware through 1.5.140116) lets remote attackers overwrite the firmware-update and configuration-restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname. The flaw is a missing-authentication weakness (CWE-306) rated CVSS 6.9 with a PR:N/UI:N vector, but impact is bounded: writes are confined to two hardcoded temp paths, so the realistic outcomes are tampering with a pending update or configuration restore and denial of service rather than arbitrary file write or direct code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and practical exposure is limited by the need for the router's management interface to be network-reachable - typically LAN-side on default deployments.
Unauthenticated attackers who can reach the management interface of a Netcore NR256CN router can bypass authentication and invoke protected management CGI handlers simply by prefixing the request URI with a recognized public route such as l7_web_auth.cgi or an .ico path. The defect affects NR256CN firmware through 1.5.140116 and is rated medium severity (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 6.9, AV:N/AC:L/PR:N/UI:N), with limited confidentiality and integrity impact on router management functions and no availability impact. No public exploit code identified at time of analysis, but exploitation is a single crafted HTTP request with no credentials or user interaction required, so the practical limiting factor is whether the management interface is reachable from an untrusted network rather than any exploitation complexity.
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.
Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.
Unauthenticated remote attackers can invoke the routerd.passwd_set function exposed through the /ubus management interface on Netcore POWER13 (build 2.0.240730.162638) to reset or recover device credentials through a weak password-recovery mechanism (CWE-640). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack is remote, low complexity, and requires neither authentication nor user interaction, though practical exposure depends on whether /ubus is reachable from the LAN only or also from the WAN; impact is scored as limited across confidentiality, integrity, and availability. Publicly available exploit code exists - a detailed proof-of-concept write-up is published on GitHub - and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis. EPSS and KEV data were not provided; this is not confirmed as actively exploited.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Integer overflow in the msg_aes_dec function of the /usr/bin/auto_ac binary on Netcore NBR100V2 routers (firmware 1.3.240614.030928) allows remote, unauthenticated attackers to cause a denial of service. The CVSS 4.0 vector scores 7.7, but the impact is availability-only (VC:N, VI:N, VA:H) per the assessed CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no code execution or data disclosure is confirmed despite the 'Information Disclosure' tag. A public exploit reference exists and the vendor did not respond to the disclosure; no vendor patch or fixed version is identified, and the CISA KEV catalog does not list this CVE.
An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.
Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.
Remote code execution in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router firmware v1.3.241114.024540 and earlier is caused by OS command injection in the www/cgi-bin/upgrade handler, allowing a network attacker to run arbitrary commands through the router's HTTP management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so unauthenticated exploitation is possible when that endpoint is reachable. No CISA KEV confirmation was provided and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), indicating low predicted exploitation activity despite the critical severity score.
Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
OS command injection in the Netcore NBR200V2 wireless router (firmware 1.3.241127.071246) lets an authenticated, low-privilege user execute arbitrary shell commands on the device by manipulating the 'url' argument passed to the Tools Ping Handler in /usr/bin/network_tools. Exploitation is network-reachable, requires no user interaction, and publicly available exploit code exists (a proof-of-concept write-up is hosted on GitHub), so any NBR200V2 whose management/diagnostics interface is reachable and whose credentials are known, guessable, or left at default should be considered at immediate risk. The vendor was contacted early but did not respond, and no fixed firmware has been identified, so no CISA KEV active-exploitation entry is associated with this issue at time of analysis. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the device itself.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.
Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.
Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.
Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.
Unauthenticated file write in the Boa-derived /bin/boa web server on Netcore NR256CN routers (firmware through 1.5.140116) lets remote attackers overwrite the firmware-update and configuration-restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname. The flaw is a missing-authentication weakness (CWE-306) rated CVSS 6.9 with a PR:N/UI:N vector, but impact is bounded: writes are confined to two hardcoded temp paths, so the realistic outcomes are tampering with a pending update or configuration restore and denial of service rather than arbitrary file write or direct code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and practical exposure is limited by the need for the router's management interface to be network-reachable - typically LAN-side on default deployments.
Unauthenticated attackers who can reach the management interface of a Netcore NR256CN router can bypass authentication and invoke protected management CGI handlers simply by prefixing the request URI with a recognized public route such as l7_web_auth.cgi or an .ico path. The defect affects NR256CN firmware through 1.5.140116 and is rated medium severity (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 6.9, AV:N/AC:L/PR:N/UI:N), with limited confidentiality and integrity impact on router management functions and no availability impact. No public exploit code identified at time of analysis, but exploitation is a single crafted HTTP request with no credentials or user interaction required, so the practical limiting factor is whether the management interface is reachable from an untrusted network rather than any exploitation complexity.
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.
Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.
Unauthenticated remote attackers can invoke the routerd.passwd_set function exposed through the /ubus management interface on Netcore POWER13 (build 2.0.240730.162638) to reset or recover device credentials through a weak password-recovery mechanism (CWE-640). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack is remote, low complexity, and requires neither authentication nor user interaction, though practical exposure depends on whether /ubus is reachable from the LAN only or also from the WAN; impact is scored as limited across confidentiality, integrity, and availability. Publicly available exploit code exists - a detailed proof-of-concept write-up is published on GitHub - and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis. EPSS and KEV data were not provided; this is not confirmed as actively exploited.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.