Overview
A third command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, in the CGI Diagnostic Endpoint at /www/cgi-bin/network_tools. Tracked as CVE-2026-94097, the flaw lets a remote, unauthenticated attacker inject shell commands via the param, key, or val arguments passed to the diagnostic CGI script. VulDB explicitly links this entry to the other command injection flaws in the same firmware build (VDB-408024, -408025, -408027, -408028).
This is part of a six-vulnerability cluster disclosed together in this firmware — see Related Reading for the full set, all traced back to network_tools building shell commands from unvalidated request parameters.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-94097 |
| Severity | Critical (CVSS 3.1: 10.0) |
| Weakness | CWE-77 (Command Injection) |
| Vulnerable File | /www/cgi-bin/network_tools |
| Component | CGI Diagnostic Endpoint |
| Parameters | param, key, val |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
| Vendor Response | Contacted early, did not respond |
How It Works
The CGI wrapper at /www/cgi-bin/network_tools exposes the same underlying diagnostic tooling as the ubus-based traceroute handler (CVE-2026-94095), but reachable directly over HTTP. The param, key, and val query arguments are concatenated into a shell command without sanitization, so an attacker who submits shell metacharacters in any of these fields can break out of the intended command and execute arbitrary instructions — reachable with a single crafted HTTP GET or POST request, no session or credentials needed.
Impact Assessment
Who Is At Risk
- Any NBR200V2 unit on firmware 1.3.241127.071246 with the
/www/cgi-bin/path reachable from an untrusted network — this is a standard web-exposed CGI path, making it a likely internet-scanning target - No vendor patch exists
Potential Impact
- Arbitrary remote command execution reachable over plain HTTP, with no
ubus-level access required — a lower bar for exploitation than CVE-2026-94095 - Full device and downstream network compromise
- High likelihood of automated mass exploitation given the simplicity of the HTTP-reachable attack surface
Mitigation
- Block external access to
/www/cgi-bin/network_toolsat the network edge; there is no vendor patch to apply - Disable WAN-facing web management entirely on affected units
- Deploy WAF rules matching shell metacharacters (
;,|,`,$() in theparam,key, andvalparameters - Audit web server access logs for requests to this endpoint with anomalous parameter values
- Prioritize this alongside CVE-2026-94095 as the two most trivially reachable flaws in the cluster
References
Related Reading
- CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
- CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
- CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
- CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
- CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration