Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

published 2026-09-20 49 d ago modified 2026-09-24 45 d ago also EUVD-2026-83808

cvss: 10.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 45 d ago (2026-09-24)

Exploit prediction

2.97% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

app.notion.com https://app.notion.com/p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA	3.0	10.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Netcore NBR200V2

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

app.notion.com /p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04
exploit
vuldb.com /vuln/408026
vdb-entry, technical-description
vuldb.com /vuln/408026/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-94097
third-party-advisory
vuldb.com /submit/892990
third-party-advisory

Sources

CVE List CVE-2026-94097
NVD CVE-2026-94097

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary