Netcore NBR200V2: Seven Critical Command Injection and Buffer Overflow Flaws Disclosed Together
Netcore NBR200V2 routers are affected by seven critical vulnerabilities, including command injection and buffer overflows, with exploits already public.
Key findings
- Seven critical vulnerabilities disclosed for Netcore NBR200V2 on September 21, 2026.
- All vulnerabilities allow for remote exploitation with CVSS scores up to 10.0.
- Six command injection flaws and two buffer overflow vulnerabilities identified.
- Affected component: Netcore NBR200V2 firmware version 1.3.241127.071246.
- Exploits for these vulnerabilities have been publicly disclosed.
On September 21, 2026, a batch of seven critical vulnerabilities was disclosed for Netcore's NBR200V2 router, all discovered within a two-hour window. These flaws, with CVSS scores ranging from 9.1 to a perfect 10.0, could allow remote attackers to gain control of affected devices. The vulnerabilities were disclosed by an unknown party, with reports indicating that exploits for these issues have been made public.
The vulnerabilities primarily stem from insecure handling of user-supplied input in various CGI endpoints and system utilities. Six of the seven CVEs are classified as command injection flaws, while the remaining two are buffer overflows.
Specifically, CVE-2026-94101 and CVE-2026-94100, both rated Critical with a CVSS score of 9.9, involve buffer overflows within the routerd utility. CVE-2026-94101 affects the VLAN configuration function vlan_load_form_uci by manipulating the wan_num argument, and CVE-2026-94100 impacts the WAN VLAN Reconfiguration component via the wan_config_set_vlan function and manipulation of the vlan_wanX.ports argument.
The remaining five vulnerabilities are command injection flaws, all carrying critical severity ratings. CVE-2026-94099 targets the Backup Restore component (restore.cgi) through manipulation of the QUERY_STRING argument. CVE-2026-94098 affects the Firmware Upgrade CGI Endpoint (/www/cgi-bin/upgrade) also via QUERY_STRING manipulation. CVE-2026-94097, the highest-rated vulnerability at CVSS 10.0, impacts the CGI Diagnostic Endpoint (/www/cgi-bin/network_tools) through manipulation of param/key/val. CVE-2026-94096 affects the LAN IP Configuration Handler (/usr/bin/network_tools) via the ipv4 argument, and CVE-2026-94095 targets the Traceroute Diagnostic Feature (/usr/bin/network_tools) by manipulating the url argument.
All disclosed vulnerabilities affect Netcore NBR200V2 devices running firmware version 1.3.241127.071246. The vendor has not yet released specific patches or updated advisories for this batch of vulnerabilities. Users are advised to monitor Netcore's official channels for security updates and consider implementing network segmentation and access controls as a mitigation strategy until patches are available. The public disclosure of exploits for these critical vulnerabilities underscores the urgency for users to update their devices once patches are released.
This coordinated disclosure of seven critical vulnerabilities highlights significant security weaknesses in the Netcore NBR200V2 router. The concentration of high-severity command injection and buffer overflow flaws, coupled with the public availability of exploits, presents a substantial risk to users. Network administrators should prioritize applying any available firmware updates from Netcore to mitigate these risks and protect their networks from potential compromise.