This vulnerability affects Netcore NBR200V2 version 1.3.241127.071246 in the CGI Diagnostic Endpoint component located at /www/cgi-bin/network_tools. An attacker can remotely manipulate the param/key/val arguments to perform command injection, leading to remote code execution without authentication. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. The vendor was contacted but did not provide a response or patch. Public exploit details have been disclosed.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This can result in loss of confidentiality, integrity, and availability of the device and network traffic passing through it. Given the critical CVSS score and remote attack vector, the impact is severe.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider isolating the affected device from untrusted networks and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.