CVE-2026-94095 Netcore CVE debrief

Who should care

Defenders responsible for Netcore NBR200V2 devices, especially those with remote access or exposed management interfaces, should assess their exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying exposure of Netcore NBR200V2 devices, especially those with remote access or exposed management interfaces, due to the remote command injection vulnerability.

• Remote exploitation of command injection vulnerability
• Potential for unauthorized access and control
• Need for input validation and sanitization
• Verification of exposure and remediation required

Technical summary

The vulnerability is located in the /usr/bin/network_tools file of the Netcore NBR200V2 device, specifically in the Traceroute Diagnostic Feature. The manipulation of the url argument leads to command injection, allowing for remote exploitation. The vulnerability affects the Netcore NBR200V2 device with version 1.3.241127.071246. The attack may be initiated remotely and the exploit has been disclosed publicly. The vendor was contacted but did not respond to the disclosure. The vulnerability has a high CVSS score of 8.6 and is considered a high-severity vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Netcore NBR200V2 devices, especially those with remote access or exposed management interfaces.

Recommended defensive actions

• Verify exposure of Netcore NBR200V2 devices
• Restrict access to the /usr/bin/network_tools file
• Implement input validation and sanitization for the url argument
• Monitor for potential exploitation attempts
• Perform vulnerability scanning and penetration testing
• Review system logs for suspicious activity
• Implement additional security controls such as firewalls and intrusion detection systems

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is needed to determine the affected versions, exploitation status, and remediation. The vulnerability has been publicly disclosed and may be used by attackers. The vendor was contacted but did not respond. Additional verification tasks are required to assess the vulnerability's impact and to identify potential entry points for exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.