Vulnerability · Published Sep 20, 2026 · Assigned by VulDB

CVE-2026-94097Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

Critical 10.0

In plain English

A critical-severity command injection in NBR200V2 from Netcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.0%top 12.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Netcore	NBR200V2	1.3.241127.071246

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-408026 | Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection vdb-entry, technical-description
VDB-408026 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-94097 | CVE Analysis and Report third-party-advisory
Submit #892990 | netcore NBR200V2 V1.3.241127.071246 Command Injection third-party-advisory
https://app.notion.com/p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04 exploit