Description

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-21T00:16:59.617Z",
  "pubdate": "2026-09-21T00:16:59.617Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in the Netcore NBR200V2 router, specifically within the LAN IP Configuration Handler component. This vulnerability stems from improper input validation of the ipv4 argument processed by the binary located at /usr/bin/network_tools.\nThe flaw allows a remote, unauthenticated attacker to execute arbitrary system commands with the privileges of the affected binary. By injecting malicious shell metacharacters into the ipv4 parameter, an adversary can achieve full system compromise, bypass security controls, and gain persistent access to the network device.\nGiven that the exploit is publicly available and the vendor has remained unresponsive to disclosure efforts, the risk level is considered high. Organizations deploying this hardware are currently without a vendor-supplied patch, necessitating immediate network-level mitigations to prevent unauthorized remote exploitation.",
  "technicalDetails": "The vulnerability is situated within the /usr/bin/network_tools binary, which serves as a handler for LAN IP configuration routines in Netcore NBR200V2 firmware version 1.3.241127.071246. The root cause of the issue is an insecure implementation of system command execution, where user-supplied input provided via the ipv4 parameter is passed directly to an underlying system shell without adequate sanitization or boundary checking.\nDuring the standard operation of the LAN IP configuration module, the application invokes internal functions that construct shell commands to interface with the network stack. An attacker can manipulate the ipv4 argument by inserting shell metacharacters (such as backticks, semicolons, or pipe symbols) followed by arbitrary commands. Because the system fails to validate the structure of the IP address string, the injected sequence is interpreted and executed by the backend shell (e.g., /bin/sh or /bin/bash).\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious HTTP request targeting the web management interface of the Netcore device, specifically reaching the endpoint associated with LAN IP configuration. Second, the attacker populates the ipv4 parameter with a payload designed to escape the intended command context. For example, injecting '192.168.1.1; [malicious_command]' forces the binary to process the legitimate configuration command followed by the injected code. Third, the /usr/bin/network_tools process executes the concatenated command string with the authority of the user executing the binary, typically root.\nThe post-exploitation impact is severe. Since the binary operates at a high privilege level, a successful command injection provides the attacker with a root shell, enabling the installation of persistent backdoors, modification of device firewall rules, exfiltration of sensitive configuration data, or lateral movement into the internal network protected by the router. Because the interface is exposed remotely, the vulnerability does not strictly require local physical access, greatly increasing the attack surface. There is no evidence of an existing patch, and the lack of vendor response suggests that the device firmware remains inherently vulnerable to this injection vector unless compensated for by external security controls."
}