Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94098

Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

CVSS 4.0 9.4 CRITICALCVSS 3.1 9.1 CRITICALCVSS 3.0 9.1 CRITICALCVSS 2.0 8.3 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94098

Published

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94098

Published

NBR200V2

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Netcore",
                    "product": "NBR200V2",
                    "versions": [
                        {
                            "version": "1.3.241127.071246",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:netcore:nbr200v2:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Firmware Upgrade CGI Endpoint"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON