CVE-2026-94098 | Netcore NBR200V2 1.3.241127.071246 Firmware Upgrade CGI Endpoint /www/cgi-bin/upgrade QUERY_STRING command injection

September 20, 2026 Yanac

A vulnerability labeled as very critical has been found in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection.

This vulnerability is documented as CVE-2026-94098. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More