SECURITYCRITICALCVE-2026-94096

CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler

Netcore NBR200V2 routers are vulnerable to unauthenticated command injection via the ipv4 argument in the LAN IP configuration handler.

Dylan H.

Security Team

September 21, 2026
3 min read
CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Netcore NBR200V2 1.3.241127.071246

Overview

A second command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, this time in the LAN IP Configuration Handler of /usr/bin/network_tools. Tracked as CVE-2026-94096, the flaw lets a remote, unauthenticated attacker inject shell commands through the ipv4 argument used when the device applies LAN IP settings.

This is one of six related vulnerabilities disclosed together in this firmware build — see Related Reading for the traceroute injection (CVE-2026-94095) and the rest of the cluster, all rooted in the same network_tools component's habit of building shell commands from unsanitized input.

Technical Details

FieldValue
CVE IDCVE-2026-94096
SeverityCritical (CVSS 3.1: 9.9)
WeaknessCWE-77 (Command Injection)
Vulnerable File/usr/bin/network_tools
ComponentLAN IP Configuration Handler
Parameteripv4
AuthenticationNone required
Exploit MaturityPublic PoC available
Vendor ResponseContacted early, did not respond

How It Works

When the router applies a LAN-side IPv4 configuration change, the ipv4 value is passed into network_tools and concatenated into a shell command without validation or escaping. Supplying shell metacharacters in place of a well-formed IP address breaks out of the intended command and executes attacker-controlled instructions on the device.

Impact Assessment

Who Is At Risk

  • Any NBR200V2 unit on firmware 1.3.241127.071246 where the LAN configuration interface is reachable — including via CSRF-style requests if the management UI is exposed to a browser that can reach the router
  • No vendor patch exists; Netcore did not respond to disclosure

Potential Impact

  • Arbitrary command execution on the router, typically with elevated privileges
  • Full network compromise via a router positioned as the gateway for every connected device
  • Persistent backdoor installation on a device most users never audit or reflash

Mitigation

  • Restrict access to the LAN configuration interface to trusted management hosts; disable it from WAN entirely
  • Apply network ACLs and monitor for unexpected configuration changes or outbound connections from the router
  • Deploy WAF/IPS rules to catch shell metacharacters in configuration parameters targeting network_tools endpoints
  • Given the lack of vendor response, treat continued use of unpatched NBR200V2 hardware as an accepted, ongoing risk

References

Related Reading