CVE-2026-94097: critical vulnerability in Netcore NBR200V2
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 3.0%
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Netcore · NBR200V2public PoCs found — 1
cve_referenceapp.notion.com/p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Netcore NBR200V2
In the same product, most dangerous first.
CVE-2026-101001CRITICALNetcore NBR200V2 Web Management network_tools eval os command injectionEPSS 2.6%CVE-2026-94098CRITICALNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionEPSS 2.4%CVE-2026-94095CRITICALNetcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionEPSS 2.4%CVE-2026-94096CRITICALNetcore NBR200V2 LAN IP Configuration network_tools command injectionEPSS 2.0%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%CVE-2026-101002CRITICALNetcore NBR200V2 Tools Ping network_tools system os command injectionEPSS 1.7%