CVE-2026-94095: Command Injection in Netcore NBR200V2 Traceroute Diagnostic Feature

Summary

CVE-2026-94095 describes a command injection vulnerability (CWE-74) affecting Netcore NBR200V2 router firmware version 1.3.241127.071246. The vulnerability resides in the Traceroute Diagnostic Feature, specifically within the file /usr/bin/network_tools. By manipulating the url argument, an attacker can inject arbitrary operating system commands. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor was contacted but did not respond.

Technical Analysis

The vulnerability is classified under CWE-74, which covers injection flaws where user-controlled input is improperly sanitized before being used in command execution contexts. In this case, the affected component is the Traceroute Diagnostic Feature of the Netcore NBR200V2 router, a network diagnostic tool typically exposed through the device’s administrative web interface.

The file /usr/bin/network_tools is the binary or script that handles network diagnostic operations on the device. Traceroute is a standard network utility that maps the path packets take from the router to a destination host. In embedded router firmware, diagnostic features like traceroute are commonly implemented as wrapper scripts or binaries that accept a destination hostname or IP address from the user and pass it to the underlying system traceroute command.

The vulnerability arises because the url argument accepted by this diagnostic feature is not properly sanitized before being incorporated into a system command. When a user submits a traceroute request through the router’s management interface, the destination value is passed to /usr/bin/network_tools, which in turn constructs and executes a shell command. If the url parameter allows special shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax, an attacker can append or inject additional commands that the underlying shell will execute.

The CVSS 4.0 vector string provides important context about the vulnerability’s characteristics:

Attack Vector (AV:N): Network — the vulnerability is exploitable over the network, meaning an attacker does not need physical or local access to the device.
Attack Complexity (AC:L): Low — exploiting the vulnerability does not require special conditions or complex preparation.
Attack Requirements (AT:N): None — no specific conditions must be met for exploitation.
Privileges Required (PR:L): Low — the attacker requires some level of authentication or privilege to access the diagnostic feature, but not administrative-level access necessarily. This suggests the traceroute diagnostic may be accessible to lower-privileged users or that the authentication boundary is weak.
User Interaction (UI:N): None — no user interaction is required beyond the attacker’s own actions.
Confidentiality, Integrity, Availability — System (VC:H/VI:H/VA:H): High impact across all three dimensions on the vulnerable system, meaning the injected command can read sensitive data, modify system state, and disrupt services.
Confidentiality, Integrity, Availability — Subsequent (SC:H/SI:H/SA:H): High impact on subsequent systems as well, indicating that compromise of the router could lead to further lateral movement or impact on other systems in the network.
Exploit Code Maturity (E:P): Proof-of-Concept — exploit code or a proof-of-concept has been made available, increasing the likelihood of exploitation in the wild.

The combination of network-based attack vector, low complexity, and high impact across both the vulnerable system and subsequent systems makes this a particularly serious vulnerability. A compromised router sits at a strategic network position, handling traffic routing, DNS resolution, and potentially firewall rules. Command injection on such a device can lead to full device compromise, traffic interception, persistent backdoors, and pivoting into internal networks.

The fact that the exploit has been publicly disclosed (E:P) and the vendor has not responded to the initial disclosure notification further compounds the risk. Without an official patch, affected devices remain vulnerable indefinitely, and the public availability of exploit details lowers the barrier for potential attackers.

Affected Software and Versions

Based on the provided vulnerability data, the following product is confirmed as affected:

Vendor: Netcore
Product: NBR200V2
Affected Version: 1.3.241127.071246
Affected Component: Traceroute Diagnostic Feature
Affected File: /usr/bin/network_tools
Vulnerable Parameter: url

The version string 1.3.241127.071246 appears to follow a date-based naming convention, suggesting a build date of November 27, 2024 (241127) with a build identifier of 071246. No information is provided about whether earlier or later versions are also affected. Details about other potentially affected versions are not fully disclosed in the available data.

No other products or versions are mentioned in the vulnerability description. Researchers and defenders should not assume that only this specific version is vulnerable without further confirmation from the vendor or additional testing. However, based strictly on the provided data, only Netcore NBR200V2 version 1.3.241127.071246 is confirmed as affected.

Impact

The impact of CVE-2026-94095 is rated as HIGH with a CVSS 4.0 base score of 8.6. The vulnerability’s impact spans multiple dimensions:

Confidentiality Impact (High): Successful command injection allows an attacker to read arbitrary files on the router, including configuration files containing credentials, SSH keys, VPN configurations, and routing tables. The router’s position in the network also enables traffic capture and inspection of data passing through the device.

Integrity Impact (High): An attacker can modify router configuration, alter routing tables, change firewall rules, inject persistent backdoors, and tamper with DNS responses. This could redirect traffic to attacker-controlled infrastructure or enable man-in-the-middle attacks against all users relying on the router.

Availability Impact (High): The attacker can disrupt network services, reboot the device, corrupt firmware, or render the router inoperable. In an enterprise or small business context, this translates to complete network outage for all connected devices.

Subsequent System Impact (High): The SC:H/SI:H/SA:H metrics indicate that compromise of the router can lead to high impact on other systems. A compromised router serves as an ideal pivot point for attacking internal networks, intercepting traffic between internal systems and the internet, and launching further attacks against connected devices that may trust the router’s network position.

Privileges Required (Low): The PR:L metric indicates that some level of authentication is needed to reach the vulnerable diagnostic feature. This reduces the pool of potential attackers compared to unauthenticated vulnerabilities, but it should not be considered a strong mitigating factor. Default credentials, weak passwords, credential reuse, and credential leaks are common issues with router deployments. Additionally, any authenticated user — even one with limited privileges — may be able to exploit this vulnerability, depending on how the diagnostic feature’s access controls are implemented.

Exploitation Scenario

The following scenario is illustrative and derived from the vulnerability description. It represents a hypothetical exploitation path based on the known facts: command injection via the url argument in the Traceroute Diagnostic Feature of /usr/bin/network_tools.

An attacker who has obtained low-privilege access to the Netcore NBR200V2 router’s management interface — whether through default credentials, credential guessing, credential leakage, or a valid low-privilege account — navigates to the diagnostic tools section of the web interface. The Traceroute Diagnostic Feature is presented as a standard network troubleshooting tool, allowing the user to enter a destination hostname or IP address and view the route that packets take to reach that destination.

Instead of entering a legitimate destination, the attacker supplies a crafted value in the url parameter that includes shell command injection payloads. For example, the attacker might append a semicolon followed by an arbitrary command, or use backtick-based command substitution, or pipe characters to chain additional commands. Because the /usr/bin/network_tools binary does not properly sanitize the url argument before passing it to the underlying system shell for traceroute execution, the injected command is executed with the privileges of the network_tools process.

On a router, the diagnostic binary typically runs with elevated privileges to perform network operations. The injected command could therefore execute as root or a similarly privileged user. The attacker could then read the router’s configuration database, extract plaintext credentials, modify iptables rules to expose additional services, install a persistent reverse shell, or configure the router to forward traffic to an attacker-controlled monitoring system.

Because the attack is network-based (AV:N) and requires no user interaction (UI:N), the attacker can automate exploitation. With the proof-of-concept already publicly available (E:P), the attack can be scripted and potentially used in scanning campaigns targeting exposed Netcore NBR200V2 routers across the internet.

Detection and Mitigation

Detection:

Organizations should monitor the Netcore NBR200V2 router’s logs for unusual activity related to the diagnostic features. Key indicators of potential exploitation include:

Unexpected or anomalous requests to the traceroute diagnostic endpoint, particularly those containing shell metacharacters such as semicolons, pipes (|), backticks (`), dollar signs ($), or command substitution patterns.
Traceroute requests with destination values that do not resemble valid IP addresses or hostnames.
Unexplained processes running on the router that were not initiated through normal administrative channels.
Unexpected outbound network connections from the router to unknown IP addresses, which could indicate a reverse shell or data exfiltration.
Changes to router configuration files, routing tables, or firewall rules that were not made through authorized administrative procedures.

Network-level detection can include monitoring for traffic patterns consistent with post-exploitation activity, such as the router initiating connections to unusual external hosts or internal scanning activity originating from the router’s IP address.

Mitigation:

As of the time of this analysis, the vendor has not responded to the disclosure notification, and no official patch or firmware update is confirmed to be available. Organizations should implement the following compensating controls:

Restrict network access: Ensure the router’s management interface is not exposed to the public internet. Limit access to the management interface to trusted internal IP ranges or VPN-connected administrators only.
Enforce strong authentication: Change any default credentials immediately. Use strong, unique passwords for all accounts on the router. If the device supports it, enable multi-factor authentication or IP-based access restrictions for the management interface.
Disable diagnostic features if unused: If the traceroute diagnostic feature is not needed for day-to-day operations, disable it or restrict access to it if the router’s interface allows such configuration.
Network segmentation: Place the router’s management interface on a separate VLAN or management network that is not accessible from general user networks.
Monitor for exploitation: Implement logging and alerting on access to diagnostic features and on anomalous behavior originating from the router.
Consider replacement: Given the vendor’s non-responsiveness, organizations should evaluate whether continued use of this device is acceptable from a risk perspective. If no patch is forthcoming, replacing the device with a vendor that maintains active security response may be the most effective long-term mitigation.

Bug Bounty Angle

For bug bounty hunters and offensive security researchers, CVE-2026-94095 highlights several valuable lessons and opportunities:

Diagnostic features as high-value targets: Network diagnostic tools — traceroute, ping, nslookup, DNS lookup, packet capture — are perennial sources of command injection vulnerabilities in router and IoT firmware. These features almost always involve passing user input to system utilities, and developers frequently neglect proper input sanitization. When testing any network device, the diagnostic section of the web interface should be one of the first areas examined.

Parameter fuzzing for injection: The url parameter in this case is the entry point for injection. When testing diagnostic features, systematically test every input field with a comprehensive set of command injection payloads. Pay attention to both common metacharacters (;, |, &, `, $()) and less obvious techniques such as newline injection, IFS manipulation, or encoding-based bypasses.

Firmware analysis: The vulnerability is identified in /usr/bin/network_tools, which suggests that firmware analysis was part of the discovery process. Researchers who extract and analyze router firmware can identify the exact code paths that handle user input, understand the sanitization (or lack thereof) applied, and craft precise exploits. Tools such as binwalk, Ghidra, and IDA Pro are essential for this type of analysis. If the firmware uses shell scripts for diagnostics, static analysis can quickly reveal command injection patterns.

Low-privilege exploitation: The PR:L metric indicates that only low privileges are required. This is significant for bug bounty programs because it means the vulnerability may be exploitable by any authenticated user, not just administrators. When testing, verify whether the diagnostic feature is accessible to read-only or guest-level accounts, as this dramatically increases the severity and potential bounty value.

Vendor non-responsiveness: The vendor was contacted but did not respond. This is unfortunately common with smaller or regional networking vendors. Bug bounty hunters should be aware that some vendors lack formal security response processes. In such cases, working through coordinated disclosure platforms, CVE assignment authorities, and public databases like VulDB becomes the primary channel for disclosure.

Expanding scope: If you find a command injection in one diagnostic feature of a router, systematically test all other diagnostic and administrative features. The same code patterns that led to the vulnerability in the traceroute feature may be replicated in ping, DNS lookup, ARP table management, or other network tools within the same firmware.

Frequently Asked Questions

What is CVE-2026-94095?

CVE-2026-94095 is a command injection vulnerability (CWE-74) in the Traceroute Diagnostic Feature of Netcore NBR200V2 firmware version 1.3.241127.071246. The url argument in /usr/bin/network_tools can be manipulated to inject arbitrary commands remotely.

What is the CVSS score for CVE-2026-94095?

The CVSS 4.0 base score is 8.6 (HIGH). The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P. It is network-exploitable, requires low privileges, and has high impact on confidentiality, integrity, and availability.

Is a proof-of-concept exploit available for CVE-2026-94095?

Yes. The vulnerability description states that the exploit has been disclosed to the public and may be used. The CVSS exploit code maturity is rated as E:P (Proof-of-Concept), indicating that exploit details are available.

Has the vendor released a patch for CVE-2026-94095?

No. The description states that the vendor was contacted early about the disclosure but did not respond in any way. No patch or firmware update is confirmed to be available based on the provided data.