SECURITYCRITICALCVE-2026-94099

CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint

The restore.cgi backup-restore endpoint on Netcore NBR200V2 routers is vulnerable to unauthenticated command injection via QUERY_STRING.

Dylan H.

Security Team

September 21, 2026
3 min read
CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Netcore NBR200V2 1.3.241127.071246

Overview

A fifth command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, in the Backup Restore component at restore.cgi. Tracked as CVE-2026-94099, the flaw lets a remote, unauthenticated attacker inject shell commands via the QUERY_STRING argument processed when a configuration backup is restored.

This is part of a six-vulnerability cluster disclosed together in this firmware — see Related Reading for the full set.

Technical Details

FieldValue
CVE IDCVE-2026-94099
SeverityCritical (CVSS 3.1: 9.9)
WeaknessCWE-77 (Command Injection)
Vulnerable Filerestore.cgi
ComponentBackup Restore
ParameterQUERY_STRING
AuthenticationNone required
Exploit MaturityPublic PoC available
Vendor ResponseContacted early, did not respond

How It Works

restore.cgi reads the request's QUERY_STRING while processing a configuration-restore operation and passes it into a shell command without sanitization. Because restore operations typically run with privileges sufficient to rewrite system configuration, an attacker who injects shell metacharacters into the query string can execute arbitrary commands in that same privileged context — no valid backup file or authentication required to trigger the underlying command execution.

Impact Assessment

Who Is At Risk

  • Any NBR200V2 unit on firmware 1.3.241127.071246 with the web management interface reachable — backup/restore functionality is frequently left enabled even on otherwise locked-down configurations
  • No vendor patch exists

Potential Impact

  • Arbitrary command execution with the privileges required to rewrite router configuration
  • Configuration tampering risk — an attacker in this code path could also manipulate the legitimate restore mechanism to push a malicious configuration in addition to direct command execution
  • Full device and downstream network compromise, consistent with the rest of the cluster

Mitigation

  • Block external access to restore.cgi; disable WAN-facing management entirely if possible
  • Deploy WAF/IPS signatures for shell metacharacters in query strings targeting the restore path
  • Audit backup/restore logs for unexpected restore operations
  • No vendor patch exists; plan for hardware replacement if continued use is required

References

Related Reading