CVE-2026-102240: Netcore NAP930 Network Tools CGI network_tools eval os command injection
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/networktools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction. An attacker can manipulate the sid argument handled by the Network Tools CGI endpoint.
How severe is the potential impact?
Successful exploitation can result in OS command injection with high impact to confidentiality, integrity, and availability. The scope is rated changed, indicating the vulnerable component could affect resources beyond its own authorization boundary.
Is public exploitation material available?
Yes. The exploit has been made public and could be used, so exposed devices should be treated as at elevated risk.
Which version is identified as affected?
The reported affected product and version is Netcore NAP930 0.1.241010.141410. No fixed version or vendor response is provided in the available information.