CVE-2026-101002: Netcore NBR200V2 Tools Ping network_tools system os command injection
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/networktools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The published vector indicates low privileges are required (PR:L), and exploitation can be initiated remotely without user interaction. The available data does not identify which authenticated role or interface provides access to the affected Tools Ping handler.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been released publicly and may be used in attacks.
Which version is confirmed affected?
Netcore NBR200V2 version 1.3.241127.071246 is identified as affected. No fixed version or vendor remediation is provided in the available data.
What should be prioritized while no vendor response is available?
Prioritize restricting remote access to the device's management functionality, particularly the Tools Ping feature that processes the url argument. The available data does not provide a vendor-supplied workaround or patch.