CVE-2026-101001 in NBR200V2
Summary
by MITRE • 09/28/2026
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The Netcore NBR200V2 router, specifically running firmware version 1.3.241127.071246, contains a critical security flaw within its Web Management Interface that allows for remote code execution through operating system command injection. This vulnerability resides in the eval function located within the /www/cgi-bin/network_tools script, which is responsible for processing network diagnostic requests such as ping or traceroute from administrative users via the web portal. The core technical failure stems from improper input validation and sanitization of the QUERY_STRING parameter passed to this evaluation engine. When a user submits data through the interface, the application directly incorporates unsanitized user-supplied input into shell commands without adequate filtering for special characters like semicolons, ampersands, or backticks that are interpreted by the underlying operating system as command separators or operators.
This architectural weakness enables an attacker to inject arbitrary Linux commands into the execution context of the router's firmware. Because the vulnerable script typically runs with elevated privileges necessary to perform network diagnostics, any injected commands will execute with the same high-level permissions, often root access. This grants a malicious actor complete control over the device, allowing them to read sensitive configuration files, modify routing tables, install persistent backdoors, or pivot into other devices on the local network segment. The severity of this issue is compounded by the fact that it can be exploited remotely without requiring prior authentication in some configurations, although even authenticated exploitation poses a severe risk due to the privilege level achieved upon successful injection.
From an industry standard perspective, this vulnerability aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector is classified under MITRE ATT&CK technique T1059, specifically sub-technique 004 for Unix Shell Commands, indicating that the adversary utilizes native command-line interfaces to execute actions on the target system. Furthermore, because the vulnerability exists in a web-facing component and allows remote exploitation, it falls squarely within the scope of CWE-94, Improper Control of Generation of Code (Code Injection), highlighting the danger of evaluating dynamic input as executable code without rigorous validation.
The operational impact of this flaw is significant for organizations relying on Netcore routers for network infrastructure security. An exploited device can serve as a foothold for lateral movement within an enterprise LAN, potentially leading to data exfiltration or disruption of critical services. The situation is further exacerbated by the public availability of exploit code and the vendor's lack of response to disclosure attempts. This absence of a patch means that defenders must rely on compensating controls rather than remediation through updates. Immediate mitigation strategies include restricting access to the web management interface via firewall rules, ensuring it is only accessible from trusted internal IP addresses or VPN connections, and disabling unnecessary services such as telnet if not explicitly required for legacy support. Additionally, implementing strict input validation at a network perimeter device can help filter out malicious payloads before they reach the vulnerable application layer until an official firmware update becomes available.