#Netcore
All CosmicBytez Labs articles tagged #Netcore, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108929: Netcore NR268 Router DDNS Argument Injection
A CVSS 9.9 argument injection flaw in Netcore NR268 router firmware lets remote attackers hijack the DDNS Hostname field to run arbitrary commands.
- Security
CVE-2026-101074: Netcore NR289-GE Pre-Authentication Stack Buffer Overflow
A critical pre-auth stack buffer overflow in Netcore NR289-GE routers lets remote attackers crash the device or potentially achieve RCE.
- Security
CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection
A critical OS command injection in Netcore NR289-GE routers lets unauthenticated attackers execute root commands via location_time.cgi.
- Security
CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection
A critical, unauthenticated OS command injection in Netcore NR289-GE routers has a public exploit, letting remote attackers run commands as root.
- Security
CVE-2026-101077: Netcore NR289-GE Authentication Bypass in the boa_temp Handler
A critical, CVSS 10 missing-authentication flaw in Netcore NR289-GE routers has a public exploit and an unresponsive vendor, with no patch in sight.
- Security
CVE-2026-101000: Missing Authorization in Netcore NBR100V2 ACL Handler
Netcore NBR100V2's ACL handler skips authorization on uci.apply, letting unauthenticated attackers tamper with device configuration remotely.
- Security
CVE-2026-101001: Netcore NBR200V2 Web Management Interface OS Command Injection via network_tools
Unauthenticated OS command injection in Netcore NBR200V2's network_tools CGI handler via QUERY_STRING gives remote attackers root-level code execution.
- Security
CVE-2026-101002: Netcore NBR200V2 Tools Ping Handler OS Command Injection
Netcore NBR200V2's Ping diagnostic tool injects an unsanitized url argument into a system() call, enabling remote command injection.
- Security
CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
An unauthenticated command injection in Netcore NBR200V2's traceroute tool lets attackers run arbitrary commands as root via ubus JSON-RPC.
- Security
CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
Netcore NBR200V2 routers are vulnerable to unauthenticated command injection via the ipv4 argument in the LAN IP configuration handler.
- Security
CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
A third command injection flaw in Netcore NBR200V2's network_tools CGI endpoint lets remote attackers run arbitrary shell commands unauthenticated.
- Security
CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
Netcore NBR200V2's firmware upgrade CGI endpoint injects the QUERY_STRING argument into a shell command, enabling unauthenticated remote injection.
- Security
CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint
The restore.cgi backup-restore endpoint on Netcore NBR200V2 routers is vulnerable to unauthenticated command injection via QUERY_STRING.
- Security
CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration
A buffer overflow in Netcore NBR200V2's routerd WAN VLAN handler can be triggered remotely via the vlan_wanX.ports argument.