Netcore NBR200V2 1.3.241127.071246 Web Management Interface network_tools eval QUERY_STRING os command injection

Summaryinfo

A vulnerability classified as very critical has been found in Netcore NBR200V2 1.3.241127.071246. Affected is the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Performing a manipulation of the argument QUERY_STRING results in os command injection. This vulnerability is identified as CVE-2026-101001. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Netcore NBR200V2 1.3.241127.071246. This affects the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. The manipulation of the argument QUERY_STRING with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-101001. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/27/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Netcore

Name

• NBR200V2

Version

• 1.3.241127.071246

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #920178: Netcore磊科 Router Firmware NBR200V2_V1.3.241127.071246 Command Injection (by llsss)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion