Overview
A fifth command injection vulnerability has been disclosed in the Netcore NBR200V2 router, firmware version 1.3.241127.071246, in the Backup Restore component at restore.cgi. Tracked as CVE-2026-94099, the flaw lets a remote, unauthenticated attacker inject shell commands via the QUERY_STRING argument processed when a configuration backup is restored.
This is part of a six-vulnerability cluster disclosed together in this firmware — see Related Reading for the full set.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-94099 |
| Severity | Critical (CVSS 3.1: 9.9) |
| Weakness | CWE-77 (Command Injection) |
| Vulnerable File | restore.cgi |
| Component | Backup Restore |
| Parameter | QUERY_STRING |
| Authentication | None required |
| Exploit Maturity | Public PoC available |
| Vendor Response | Contacted early, did not respond |
How It Works
restore.cgi reads the request's QUERY_STRING while processing a configuration-restore operation and passes it into a shell command without sanitization. Because restore operations typically run with privileges sufficient to rewrite system configuration, an attacker who injects shell metacharacters into the query string can execute arbitrary commands in that same privileged context — no valid backup file or authentication required to trigger the underlying command execution.
Impact Assessment
Who Is At Risk
- Any NBR200V2 unit on firmware 1.3.241127.071246 with the web management interface reachable — backup/restore functionality is frequently left enabled even on otherwise locked-down configurations
- No vendor patch exists
Potential Impact
- Arbitrary command execution with the privileges required to rewrite router configuration
- Configuration tampering risk — an attacker in this code path could also manipulate the legitimate restore mechanism to push a malicious configuration in addition to direct command execution
- Full device and downstream network compromise, consistent with the rest of the cluster
Mitigation
- Block external access to
restore.cgi; disable WAN-facing management entirely if possible - Deploy WAF/IPS signatures for shell metacharacters in query strings targeting the restore path
- Audit backup/restore logs for unexpected restore operations
- No vendor patch exists; plan for hardware replacement if continued use is required
References
Related Reading
- CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
- CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
- CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
- CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
- CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration