CVE-2026-94098: Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NBR200V2 firmwareto a version that resolves this vulnerability.Fixed in 1.3.241127.071246 - Compensating control
Restrict network access to the Firmware Upgrade CGI Endpoint at /www/cgi-bin/upgrade (e.g., via firewall/ACL/WAF) to trusted management sources only, since the command injection can be executed remotely.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be executed remotely against the firmware upgrade CGI endpoint. The supplied data does not state whether authentication is required, although the CVSS vector indicates high privileges are required.
Which systems are known to be affected?
Netcore NBR200V2 version 1.3.241127.071246 is identified as affected. The vulnerable component is the firmware upgrade CGI endpoint at /www/cgi-bin/upgrade.
Is public exploit code available?
Yes. The exploit is publicly available and may be used by attackers.
Is a vendor fix available?
The provided information does not identify a fix. It states that the vendor was contacted early but did not respond.