Overview
CVE-2026-101002 affects the same Netcore NBR200V2 firmware (1.3.241127.071246) as the related CVE-2026-101001, but targets a different code path: the Tools Ping Handler in /usr/bin/network_tools. Its system function passes the url argument straight into a shell command without sanitization, classified under CWE-78 (OS Command Injection). Trackers report a CVSS 3.1 score of 9.9 (Critical) and a CVSS 4.0 score of 8.6 (High) — the CVSS 3.1 vector notes low privileges required (PR:L), a modest but still low bar distinguishing it from the fully unauthenticated CVE-2026-101001.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-101002 |
| Severity | Critical (CVSS 3.1: 9.9 / CVSS 4.0: 8.6) |
| Weakness | CWE-78 (OS Command Injection) |
| Vulnerable File | /usr/bin/network_tools |
| Function | system |
| Component | Tools Ping Handler |
| Parameter | url |
| Authentication | Low privileges required (CVSS 3.1: PR:L) |
| Exploit Maturity | Public PoC available |
| Vendor Response | Contacted early, did not respond |
How It Works
The NBR200V2's built-in Ping diagnostic tool takes a target url argument from the caller and passes it to a system() call in /usr/bin/network_tools without neutralizing shell metacharacters. An attacker who can reach this handler — needing only low-level privileges rather than none, per the CVSS 3.1 vector — can supply a crafted url value that breaks out of the intended ping invocation and executes arbitrary commands on the device. As with the related CVE-2026-101001, public proof-of-concept code exists and the estimated underground exploit value sits in the $0–$5,000 range.
Impact Assessment
Who Is At Risk
- Any NBR200V2 unit on firmware 1.3.241127.071246 with the network diagnostic (Ping) tool reachable and any low-privilege access available to an attacker
- No vendor patch exists
Potential Impact
- Remote code execution on the device, affecting confidentiality, integrity, and availability
- Because this and CVE-2026-101001 share the same
network_toolsbinary, a device exposed to one is very likely exposed to the other — treat the pair as a single remediation unit - Chainable with CVE-2026-101000 (unauthenticated configuration tampering) for a fuller compromise path on mixed NBR100V2/NBR200V2 deployments
Mitigation
- Restrict access to the diagnostic/Ping tooling in the web management interface to trusted, authenticated administrators only
- Apply the principle of least privilege to any accounts capable of reaching
network_tools, since this flaw requires at least low-level access rather than none - Deploy network-layer monitoring for anomalous
urlparameter values containing shell metacharacters submitted to the Ping tool - No vendor patch exists; organizations should treat NBR200V2 hardware on this firmware version as unsuitable for continued production use