Overview
A fourth command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, this time in the Firmware Upgrade CGI Endpoint at /www/cgi-bin/upgrade. Tracked as CVE-2026-94098, the flaw lets a remote, unauthenticated attacker inject shell commands via the QUERY_STRING argument processed by the upgrade handler.
This is part of a six-vulnerability cluster disclosed together in this firmware — see Related Reading for the full set, all sharing the same root cause of unsanitized input reaching a shell command.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-94098 |
| Severity | Critical (CVSS 3.1: 9.1) |
| Weakness | CWE-77 (Command Injection) |
| Vulnerable File | /www/cgi-bin/upgrade |
| Component | Firmware Upgrade CGI Endpoint |
| Parameter | QUERY_STRING |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
| Vendor Response | Contacted early, did not respond |
How It Works
The firmware upgrade CGI script reads the raw QUERY_STRING of the incoming request and passes it into a shell command — likely to locate or validate a firmware image — without sanitizing shell metacharacters. An attacker who appends command separators to the query string can execute arbitrary commands in the context of the upgrade process, which on embedded router firmware typically runs with elevated privileges given it needs to write to flash storage.
Impact Assessment
Who Is At Risk
- Any NBR200V2 unit on firmware 1.3.241127.071246 with the web management interface reachable, since firmware upgrade endpoints are commonly left accessible even when other admin functions are locked down
- No vendor patch exists
Potential Impact
- Arbitrary command execution with the elevated privileges the firmware upgrade process requires to write to flash
- Malicious firmware persistence risk — an attacker who can already reach the upgrade endpoint's command context is one step from tampering with the upgrade path itself, raising the possibility of a persistent, boot-surviving backdoor
- Full device and network compromise, consistent with the rest of this vulnerability cluster
Mitigation
- Block external access to
/www/cgi-bin/upgrade; disable WAN-facing management entirely if possible - Deploy WAF/IPS signatures for shell metacharacters in query strings targeting the upgrade path
- Verify firmware integrity on any device that may have been exposed — if compromise via this endpoint is suspected, a factory reset and clean reflash from a trusted source is warranted rather than trusting an in-place "upgrade"
- No vendor patch exists; plan for hardware replacement if continued use is required
References
Related Reading
- CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
- CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
- CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
- CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
- CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration