Vulnerability · Published Sep 20, 2026 · Assigned by VulDB
CVE-2026-94095Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
Critical 9.9
In plain English
A critical-severity command injection in NBR200V2 from Netcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-408024 | Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection vdb-entry, technical-description
- VDB-408024 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-94095 | CVE Analysis and Report third-party-advisory
- Submit #892986 | netcore NBR200V2 V1.3.241127.071246 Command Injection third-party-advisory
- https://app.notion.com/p/Netcore-NBR200V2-Vul-3-39f797159f15802296c7f6e110363435 exploit