Description

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-21T00:16:59.793Z",
  "pubdate": "2026-09-21T00:16:59.793Z",
  "executiveSummary": "A critical command injection vulnerability exists within the CGI Diagnostic Endpoint of the Netcore NBR200V2 router, specifically located in the /www/cgi-bin/network_tools file.\nThis vulnerability allows an unauthenticated, remote attacker to execute arbitrary system commands with elevated privileges by manipulating input arguments.\nThe flaw stems from insufficient sanitization of parameters passed to the diagnostic utility, enabling the injection of malicious shell metacharacters.\nSuccessful exploitation facilitates complete system compromise, allowing attackers to gain unauthorized access, modify system configurations, or deploy persistent malware.\nGiven the public availability of exploit code and the lack of vendor response, the risk to exposed NBR200V2 devices is critical.\nThis vulnerability can be exploited remotely over the network, requiring no prior authentication, thereby significantly increasing the attack surface.",
  "technicalDetails": "The vulnerability resides in the CGI-based network diagnostics component of the Netcore NBR200V2, specifically within the executable or script mapped to /www/cgi-bin/network_tools.\nThe root cause is an improper neutralization of special elements used in an OS command ('OS Command Injection'). The application accepts user-supplied input via the param, key, or val arguments without adequate validation or filtering before passing these inputs to a system call or shell execution environment.\nWhen an attacker crafts a malicious request targeting the /www/cgi-bin/network_tools endpoint, they can append shell command delimiters (such as ';', '|', or '&&') to the input parameters. Because the underlying system processes these inputs as part of a shell command string, the injected malicious code is executed with the privileges of the CGI process, which often operates as root on such embedded devices.\nThe attack flow begins with the attacker identifying the target endpoint on a network-exposed NBR200V2 device. The attacker sends a crafted HTTP GET or POST request to /www/cgi-bin/network_tools. By embedding shell metacharacters into the arguments, the attacker triggers the execution of arbitrary commands. For instance, injecting '; uname -a' or '; /bin/sh -c [malicious_payload]' allows the attacker to execute OS commands.\nAs this CGI endpoint handles administrative diagnostic functions, the application likely runs with sufficient permissions to execute network commands (e.g., ping, traceroute, or nslookup). By subverting these diagnostic utilities, the attacker achieves command injection.\nThe post-exploitation impact is severe, as the attacker can establish a reverse shell, exfiltrate sensitive configuration data, modify system binaries, or pivot deeper into the internal network. The lack of input sanitization means the application performs no logical checks on the payload, essentially passing unfiltered data directly to system-level interpreters.\nThis vulnerability affects Netcore NBR200V2 version 1.3.241127.071246. Because the vulnerability is remotely exploitable and does not require authentication, it represents a significant security risk for any deployment where the device management interface is accessible from the WAN or untrusted network segments."
}