This vulnerability affects Netcore NBR200V2 firmware version 1.3.241127.071246. It arises from improper handling of the QUERY_STRING argument in the /www/cgi-bin/upgrade CGI endpoint used for firmware upgrades. An attacker can remotely inject commands via this parameter, leading to command injection. The exploit is publicly available, increasing the risk of exploitation. The vendor has not issued any response or fix at the time of this report.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise. Given the critical CVSS score of 9.4 and the availability of public exploit code, this vulnerability poses a severe risk to affected devices.

No official patch or remediation is currently available from the vendor. Users should consider isolating affected devices from untrusted networks and monitor for suspicious activity. Due to the lack of vendor response, alternative mitigations such as disabling remote firmware upgrade interfaces or applying network-level access controls may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.