---
id: CVE-2026-94097
title: A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246
summary: >-
  A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This
  affects an unknown part of the file /www/cgi-bin/network_tools of the
  component CGI Diagnostic Endpoint. This manipulation of the argument
  param/key/val causes co…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-74
  - CWE-77
vendor: Netcore
product: NBR200V2
affected:
  - NBR200V2 1.3.241127.071246
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94097'
references:
  - url: >-
      https://app.notion.com/p/Netcore-NBR200V2-Vul-5-39f797159f15809dbc06d2d3ae6b1f04
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-94097'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/892990'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408026'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408026/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
epss: 0.01989
epssPercentile: 0.7951
ingestedAt: '2026-09-21T00:28:47.398Z'
---

## Overview

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.