Threat database

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101000 is a critical vulnerability in Netcore NBR100V2 version 1.3.240614.030928. It involves missing authorization in the ACL Handler component, specifically in the uci.apply function of the /usr/share/rpcd/acl.d/unauthenticated.json file. This flaw allows remote attackers to manipulate arguments and bypass authorization controls. The vulnerability has a maximum CVSS score of 10, indicating severe impact. The vendor has not responded to the disclosure, and no patch or mitigation guidance is currently available. Exploit code has been publicly disclosed, but there are no confirmed reports of exploitation in the wild.

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-94100 is a critical buffer overflow vulnerability in Netcore NBR200V2 version 1.3.241127.071246. The flaw exists in the wan_config_set_vlan function within /usr/bin/routerd, specifically in the WAN VLAN Reconfiguration component. An attacker can remotely manipulate the vlan_wanX.ports argument to trigger the overflow. Exploit code has been publicly released, increasing the risk of attacks. The vendor has not responded to the disclosure and no patch information is available.

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERY_STRING results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-94098 is a critical command injection vulnerability in the Netcore NBR200V2 router firmware version 1.3.241127.071246. The flaw exists in the Firmware Upgrade CGI endpoint (/www/cgi-bin/upgrade) where manipulation of the QUERY_STRING argument allows remote attackers to execute arbitrary commands. Exploit code is publicly available, but the vendor has not responded or provided a fix. This vulnerability enables remote command execution with high impact.

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-94096 is a critical command injection vulnerability in Netcore NBR200V2 version 1.3.241127.071246. The flaw exists in the LAN IP Configuration Handler component, specifically in the /usr/bin/network_tools file, where manipulation of the ipv4 argument allows remote attackers to execute arbitrary commands. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available. Exploit code has been publicly released but no known exploitation in the wild has been reported.

CVE-2026-94095 is a critical command injection vulnerability in Netcore NBR200V2 version 1.3.241127.071246. It affects the Traceroute Diagnostic Feature's /usr/bin/network_tools file, where manipulation of the 'url' argument can lead to remote command execution. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. Exploitation requires no user interaction and has a high impact on confidentiality, integrity, and availability.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

Netcore NR255-V version 1.5.130703 has a vulnerability that allows attackers to disclose sensitive information. Specifically, querying certain CGI endpoints can expose stored IPsec pre-shared keys (PSK) and RSA key material. This vulnerability is due to insufficient protection of credentials in the device's web interface handlers.

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the DHCP dynamic IP display and ARP bind list components. This vulnerability arises from improper neutralization of input in hostname fields, allowing a LAN-based attacker to inject malicious scripts that are rendered in the web management interface.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine. This flaw is triggered by uploading a truncated firmware image via the put_file_cgi.c interface, causing out-of-bounds reads in multiple components. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory.

Netcore NR255-V version 1.5.130703 has a null pointer dereference vulnerability in the route_policy_add.cgi component. This occurs when a request is sent without the required exit_port parameter, causing the device to dereference a null pointer and leading to a denial of service condition.