CVE-2026-94096: critical vulnerability in Netcore NBR200V2
Netcore NBR200V2 LAN IP Configuration network_tools command injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 2.0%
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Netcore · NBR200V2public PoCs found — 1
cve_referenceapp.notion.com/p/Netcore-NBR200V2-Vul-4-39f797159f158004b8baf1bbf3b956caunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Netcore NBR200V2
In the same product, most dangerous first.
CVE-2026-94097CRITICALNetcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionEPSS 3.0%CVE-2026-101001CRITICALNetcore NBR200V2 Web Management network_tools eval os command injectionEPSS 2.6%CVE-2026-94098CRITICALNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionEPSS 2.4%CVE-2026-94095CRITICALNetcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionEPSS 2.4%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%CVE-2026-101002CRITICALNetcore NBR200V2 Tools Ping network_tools system os command injectionEPSS 1.7%