CVE-2026-94099 Netcore CVE debrief

Who should care

Defenders responsible for Netcore NBR200V2 devices, especially those with Backup Restore functionality enabled, should assess exposure and potential impact of command injection attacks. This includes verifying the exposure of devices, assessing the impact of potential attacks, and monitoring for suspicious activity. Security teams should prioritize verifying exposure and assessing potential impact to ensure the security of their systems.

Why it matters

Defenders should prioritize verifying exposure of Netcore NBR200V2 devices to command injection attacks and assess potential impact on Backup Restore functionality.

• Verify exposure of Netcore NBR200V2 devices to command injection attacks
• Assess potential impact on Backup Restore functionality
• Monitor for suspicious activity on Netcore NBR200V2 devices

Technical summary

The vulnerability is caused by a command injection issue in the restore.cgi file of the Backup Restore component in Netcore NBR200V2 1.3.241127.071246. The attack can be carried out remotely by manipulating the QUERY_STRING argument. This could allow attackers to execute arbitrary commands on the affected system, potentially leading to a complete compromise of the device. The vulnerability has been publicly disclosed and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Defensive priority

Defenders should prioritize verifying exposure of Netcore NBR200V2 devices, especially those with Backup Restore functionality enabled, and assess the impact of potential command injection attacks.

Recommended defensive actions

• Verify exposure of Netcore NBR200V2 devices
• Assess impact of potential command injection attacks
• Monitor for suspicious activity on Backup Restore functionality
• Review vendor guidance for updates or mitigations
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions, exploitation status, and remediation. The lack of detailed information from the vendor makes it difficult to assess the full impact of this vulnerability. Defenders should verify the exposure of Netcore NBR200V2 devices, especially those with Backup Restore functionality enabled, and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.