This vulnerability affects Netcore Power 15AX devices running firmware up to version 3.0.0.6938. The issue lies in the setTools function of the /bin/netis.cgi component, which processes the IpAddr argument insecurely, allowing an attacker to inject and execute arbitrary operating system commands remotely. The CVSS 4.0 base score is 8.7, indicating a high-severity risk with network attack vector, no required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided a patch or advisory, and the exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full compromise of the device, unauthorized access to sensitive data, disruption of device functionality, and further network compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider disabling or restricting access to the vulnerable Diagnostic Tool Interface if possible, and monitor for unusual activity. Avoid exposure of the device management interface to untrusted networks until a patch is released.