This vulnerability in Netcore NBR200V2 firmware 1.3.241127.071246 allows remote command injection through improper handling of the QUERY_STRING parameter in the restore.cgi script of the Backup Restore component. An attacker can remotely manipulate this parameter to execute arbitrary system commands on the device. The flaw is critical with a CVSS 4.0 score of 9.4, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not provided any response or patch, and public exploit code is available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full system compromise. This can result in unauthorized access, data theft, device control, or disruption of services. Given the critical severity and public availability of exploits, affected devices are at significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider isolating affected devices from untrusted networks and monitoring for suspicious activity until a patch or official mitigation is released.