Description

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-21T01:16:29.800Z",
  "pubdate": "2026-09-21T01:16:29.800Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the Netcore NBR200V2 router, specifically within the firmware upgrade mechanism. The vulnerability resides in the /www/cgi-bin/upgrade component and is triggered via the manipulation of the QUERY_STRING argument.\nThis flaw allows a remote, unauthenticated attacker to execute arbitrary system commands with elevated privileges on the underlying operating system. The vulnerability poses a severe risk to device integrity, as successful exploitation results in full system compromise, potential persistent backdoor installation, and unauthorized access to the network infrastructure.\nGiven that the exploit is publicly available and the vendor has failed to respond to vulnerability disclosures, the risk to deployed systems is high. The vulnerability does not require prior authentication, significantly lowering the barrier for exploitation by malicious actors scanning for internet-exposed network devices.",
  "technicalDetails": "The vulnerability is a classic command injection flaw located within the binary or script responsible for handling firmware upgrades, specifically exposed through the /www/cgi-bin/upgrade CGI endpoint.\nThe root cause is improper neutralization of special elements used in an OS command within the QUERY_STRING parameter. The application fails to sanitize or validate user-supplied input before passing it to a system-level function (such as system(), popen(), or equivalent shell execution primitives).\nAn attacker can exploit this by crafting a malicious QUERY_STRING containing shell metacharacters (e.g., ';', '&', '|', or backticks) followed by the desired payload. When the /www/cgi-bin/upgrade endpoint processes the request, the application concatenates the unsanitized string into a command buffer, leading to the execution of the injected malicious code by the web server process.\nThe exploitation process follows these steps: 1) The attacker sends an HTTP request to the /www/cgi-bin/upgrade endpoint. 2) The malicious payload is embedded within the QUERY_STRING of the GET request. 3) The target device's CGI handler incorrectly parses the input, treating the injected command as a parameter to the shell execution. 4) The shell interprets the command sequence, resulting in the unauthorized execution of OS-level instructions with the privileges of the web service.\nBecause the service runs with high privileges, the injected code gains full control over the device. Post-exploitation impact includes, but is not limited to, modification of system configurations, extraction of sensitive information (such as administrator credentials or Wi-Fi keys), denial of service, and the ability to use the device as a pivot point for further lateral movement within the internal network. The lack of input validation at the CGI gateway is the primary technical failure, rendering the component insecure against remote command injection attacks."
}