CVE-2026-101001

CRITICALCVSS 10.0

Description

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Timeline

Published:September 28th, 2026 5:16 AM

Last modified:September 28th, 2026 3:15 PM

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2: 10.0

Weaknesses (CWE)

CWE-77 CWE-78

References & Reports

Advisories, patches, and third-party reports

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR200V2_V1.3.241127.071246%20Router/Netcore_NBR200V2_network_tools_command_injection.md
https://vuldb.com/cve/CVE-2026-101001
https://vuldb.com/submit/920178
https://vuldb.com/vuln/410871
https://vuldb.com/vuln/410871/cti

Source: NIST NVD · Data may lag official sources by up to one minute