CVE-2026-102240 in NAP930
Summary
by MITRE • 09/29/2026
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Netcore NAP930 firmware version 0.1.241010.141410 represents a critical security flaw within the Network Tools CGI component, specifically affecting the eval function located in the /www/cgi-bin/network_tools script. This issue is classified as an Operating System Command Injection vulnerability, which corresponds to CWE-78 in the Common Weakness Enumeration standard. The root cause lies in the improper neutralization of special elements used in operating system commands, allowing an attacker to inject and execute arbitrary shell commands on the underlying host system. The specific vector for this exploitation involves the manipulation of the sid argument passed to the network tools interface. Because the application fails to adequately sanitize or validate user-supplied input before passing it to a system-level interpreter, malicious actors can construct payloads that bypass intended logic and trigger unintended command execution with the privileges of the web server process.
From an operational perspective, this vulnerability poses a severe risk due its remote exploitability. An attacker does not require physical access or prior authentication credentials if the CGI interface is exposed without proper access controls, which is common in many IoT router configurations. The fact that public exploits have been developed and disseminated significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated attacks targeting vulnerable devices across the internet. Successful exploitation can lead to a complete compromise of the device, allowing attackers to pivot into internal networks, exfiltrate sensitive data, install persistent backdoors, or use the compromised router as part of a larger botnet infrastructure. The lack of vendor response further exacerbates the risk profile, leaving users without official patches or mitigation guidance and forcing reliance on community-developed workarounds or network-level filtering to mitigate exposure.
This type of vulnerability aligns with several techniques in the MITRE ATT&CK framework for both initial access and execution phases. Specifically, it relates to Command and Scripting Interpreter abuse where attackers leverage system utilities like sh or bash to execute commands remotely. The persistence achieved through such injections often falls under Persistence mechanisms involving scheduled tasks or modified startup scripts. Given that Netcore devices are frequently deployed in residential and small business environments with weak default security postures, the impact is amplified by the potential for lateral movement into more secure internal segments. Administrators should immediately assess whether this specific firmware version is present on their network infrastructure. In the absence of a vendor-provided patch, mitigation strategies must focus on strict access control lists to restrict CGI endpoint accessibility to trusted IP addresses only, disabling unnecessary remote management features, and monitoring network traffic for anomalous outbound connections or unusual command patterns originating from the device. Regular vulnerability scanning and firmware updates remain essential practices to maintain security hygiene in IoT deployments.