CVE-2026-94096
Netcore NBR200V2 LAN IP Configuration network_tools command injection
- State
- Published
- Severity
- 9.4 Critical
- Published
- Sep 20, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 20, 2026
Description
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 9.9 Critical | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
NBR200V2Netcore |
|
References
- VDB-408025 | Netcore NBR200V2 LAN IP Configuration network_tools command injectionvdb-entrytechnical-description
- VDB-408025 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-94096 | CVE Analysis and Reportthird-party-advisory
- Submit #892988 | netcore NBR200V2 V1.3.241127.071246 Command Injectionthird-party-advisory
- https://app.notion.com/p/Netcore-NBR200V2-Vul-4-39f797159f158004b8baf1bbf3b956caexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.