CVE-2026-4840: Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection
A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4840?
CVE-2026-4840 has a medium severity level due to the potential for remote code execution through command injection.
How do I fix CVE-2026-4840?
To fix CVE-2026-4840, update the Netcore Power 15AX to a version beyond 3.0.0.6938 where the vulnerability has been addressed.
What versions are affected by CVE-2026-4840?
CVE-2026-4840 affects Netcore Power 15AX versions up to and including 3.0.0.6938.
What type of vulnerability is CVE-2026-4840?
CVE-2026-4840 is classified as an OS command injection vulnerability found in the Diagnostic Tool Interface.
Can CVE-2026-4840 be exploited remotely?
Yes, CVE-2026-4840 can be exploited remotely by an attacker capable of interacting with the affected setTools function.