CRITICAL

CVE-2026-94097

2026-09-21 CVSS v3.1

CVSS

Description

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness (CWE)

CWE-74 Injection

CWE-77 Command Injection

References

https://app.notion.com/p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04 https://vuldb.com/cve/CVE-2026-94097 https://vuldb.com/submit/892990 https://vuldb.com/vuln/408026 https://vuldb.com/vuln/408026/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE