Overview
A second command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, this time in the LAN IP Configuration Handler of /usr/bin/network_tools. Tracked as CVE-2026-94096, the flaw lets a remote, unauthenticated attacker inject shell commands through the ipv4 argument used when the device applies LAN IP settings.
This is one of six related vulnerabilities disclosed together in this firmware build — see Related Reading for the traceroute injection (CVE-2026-94095) and the rest of the cluster, all rooted in the same network_tools component's habit of building shell commands from unsanitized input.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-94096 |
| Severity | Critical (CVSS 3.1: 9.9) |
| Weakness | CWE-77 (Command Injection) |
| Vulnerable File | /usr/bin/network_tools |
| Component | LAN IP Configuration Handler |
| Parameter | ipv4 |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
| Vendor Response | Contacted early, did not respond |
How It Works
When the router applies a LAN-side IPv4 configuration change, the ipv4 value is passed into network_tools and concatenated into a shell command without validation or escaping. Supplying shell metacharacters in place of a well-formed IP address breaks out of the intended command and executes attacker-controlled instructions on the device.
Impact Assessment
Who Is At Risk
- Any NBR200V2 unit on firmware 1.3.241127.071246 where the LAN configuration interface is reachable — including via CSRF-style requests if the management UI is exposed to a browser that can reach the router
- No vendor patch exists; Netcore did not respond to disclosure
Potential Impact
- Arbitrary command execution on the router, typically with elevated privileges
- Full network compromise via a router positioned as the gateway for every connected device
- Persistent backdoor installation on a device most users never audit or reflash
Mitigation
- Restrict access to the LAN configuration interface to trusted management hosts; disable it from WAN entirely
- Apply network ACLs and monitor for unexpected configuration changes or outbound connections from the router
- Deploy WAF/IPS rules to catch shell metacharacters in configuration parameters targeting
network_toolsendpoints - Given the lack of vendor response, treat continued use of unpatched NBR200V2 hardware as an accepted, ongoing risk
References
Related Reading
- CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
- CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
- CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
- CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
- CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration