Netcore

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-101076	An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.	CRITICAL	9.3	2.0%	69	PoC No patch
CVE-2026-102240	OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.	CRITICAL	9.3	2.0%	69	PoC No patch
CVE-2026-108907	Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.	CRITICAL	9.3	1.2%	68	PoC No patch
CVE-2026-101000	Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.	CRITICAL	9.3	0.5%	67	PoC No patch
CVE-2026-101001	Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.	CRITICAL	9.3	2.6%	66	PoC No patch
CVE-2026-101072	Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.	CRITICAL	9.3	2.0%	66	PoC No patch
CVE-2026-101075	Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.	CRITICAL	9.3	2.5%	66	PoC No patch
CVE-2026-101077	Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.	CRITICAL	9.3	0.7%	66	PoC No patch
CVE-2026-94098	Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.	HIGH	8.5	2.4%	65	PoC No patch
CVE-2026-94099	Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.	HIGH	8.6	1.7%	65	PoC No patch
CVE-2026-94095	Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.	HIGH	8.6	1.7%	65	PoC No patch
CVE-2026-101074	Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.	HIGH	8.9	1.3%	64	PoC No patch
CVE-2026-94100	Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.	HIGH	8.6	0.5%	63	PoC No patch
CVE-2026-94096	Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.	HIGH	8.6	1.7%	63	PoC No patch
CVE-2026-94101	Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.	HIGH	8.6	0.4%	63	PoC No patch

CVE-2026-101076

An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.

CRITICAL

9.3

2.0%

69

PoC No patch

CVE-2026-102240

OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.

CRITICAL

9.3

2.0%

69

PoC No patch

CVE-2026-108907

Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.

CRITICAL

9.3

1.2%

68

PoC No patch

CVE-2026-101000

Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.

CRITICAL

9.3

0.5%

67

PoC No patch

CVE-2026-101001

Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.

CRITICAL

9.3

2.6%

66

PoC No patch

CVE-2026-101072

Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.

CRITICAL

9.3

2.0%

66

PoC No patch

CVE-2026-101075

Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.

CRITICAL

9.3

2.5%

66

PoC No patch

CVE-2026-101077

Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.

CRITICAL

9.3

0.7%

66

PoC No patch

CVE-2026-94098

Command injection in the Netcore NBR200V2 router's firmware upgrade CGI endpoint (/www/cgi-bin/upgrade) allows authenticated administrative attackers to execute arbitrary shell commands by manipulating the QUERY_STRING parameter. The flaw affects firmware version 1.3.241127.071246, and publicly available exploit code exists. The vendor did not respond to disclosure, so no official fix is available; exploitation requires reaching the admin interface, which is typically LAN-only unless remote management is enabled.

HIGH

8.5

2.4%

65

PoC No patch

CVE-2026-94099

Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated attacker who can reach the web management interface to run arbitrary shell commands on the device by manipulating the QUERY_STRING argument processed by restore.cgi in the Backup Restore component. The flaw is network-reachable, requires only low privileges (CVSS PR:L) with no user interaction, and produces high confidentiality, integrity and availability impact - on embedded routers this typically equates to root-level control of the device's OS. Publicly available exploit code has been released and the vendor did not respond to the disclosure, so no patch is available; the CVE is not listed in CISA KEV, meaning active exploitation has not been confirmed.

HIGH

8.6

1.7%

65

PoC No patch

CVE-2026-94095

Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.

HIGH

8.6

1.7%

65

PoC No patch

CVE-2026-101074

Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.

HIGH

8.9

1.3%

64

PoC No patch

CVE-2026-94100

Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.

HIGH

8.6

0.5%

63

PoC No patch

CVE-2026-94096

Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.

HIGH

8.6

1.7%

63

PoC No patch

CVE-2026-94101

Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.

HIGH

8.6

0.4%

63

PoC No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (10)

Top Risky CVEs