CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it over the network. The affected CGI diagnostic endpoint processes attacker-controlled param, key, or val arguments in a way that enables command injection.
Is exploitation theoretical or publicly available?
Public exploit disclosure has occurred, and the disclosed exploit may be usable. This increases the likelihood of exploitation attempts against reachable affected devices.
Which product version is identified as affected?
The reported affected version is Netcore NBR200V2 1.3.241127.071246. The available information does not identify fixed versions or configuration-specific limitations.
Is there vendor remediation information available?
No vendor response or remediation information is provided. The vendor was reportedly contacted before disclosure but did not respond.