CVE-2026-101001

9.3 criticalEPSS 2.6%

Critical (9.3). EPSS 2.6% chance of exploitation in the next 30 days.

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-09-28
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR200V2_V1.3.241127.071246%20Router/Netcore_NBR200V2_network_tools_command_injection.md
https://vuldb.com/cve/CVE-2026-101001
https://vuldb.com/submit/920178
https://vuldb.com/vuln/410871
https://vuldb.com/vuln/410871/cti

Check your stack JSON