CVE-2026-94099: Netcore NBR200V2 Backup Restore restore.cgi command injection
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERYSTRING results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker can exploit it remotely, but must have low-privileged access or credentials, as indicated by the PR:L vector. No user interaction is required.
Which deployments should be treated as affected?
Netcore NBR200V2 devices running version 1.3.241127.071246 should be treated as affected. The available information does not say whether other versions or default configurations are affected.
How mature is the exploit risk?
A public exploit has been released and may be used in attacks. The exploitability assessment is rated as proof-of-concept (E:P).
Is a vendor fix available?
The provided information does not identify a fix or mitigation. It states that the vendor was contacted before disclosure but did not respond.