CVE-2026-94095 Overview
CVE-2026-94095 is a command injection vulnerability in the Netcore NBR200V2 router running firmware version 1.3.241127.071246. The flaw resides in the /usr/bin/network_tools binary, specifically within the Traceroute Diagnostic Feature. Attackers can manipulate the url argument to inject arbitrary operating system commands. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Exploitation requires network access and low-level authentication, but no user interaction. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can execute arbitrary commands on the router with device-level privileges, enabling full compromise of the network gateway.
Affected Products
- Netcore NBR200V2 router
- Firmware version 1.3.241127.071246
- Traceroute Diagnostic Feature within /usr/bin/network_tools
Discovery Timeline
- 2026-09-21 - CVE-2026-94095 published to NVD
- 2026-09-21 - Last updated in NVD database
- Vendor response - Netcore was contacted early but did not respond to the disclosure
Technical Details for CVE-2026-94095
Vulnerability Analysis
The vulnerability affects the Traceroute diagnostic functionality exposed by the Netcore NBR200V2 web management interface. When a user submits a traceroute request, the router invokes /usr/bin/network_tools and passes the user-supplied url argument to an underlying shell context without sufficient sanitization. Attackers can append shell metacharacters to the url parameter to break out of the intended command and execute arbitrary operating system commands. Because the traceroute utility on embedded routers typically runs with elevated privileges, successful exploitation grants the attacker control equivalent to the service account executing the network tool. This class of flaw commonly leads to full device takeover on consumer and small-office network hardware.
Root Cause
The root cause is improper neutralization of special elements passed into a downstream command interpreter [CWE-74]. The network_tools binary constructs a shell command string using the attacker-controlled url argument without escaping shell metacharacters such as ;, |, &, or backticks. This design pattern allows injected payloads to be interpreted as additional commands rather than data.
Attack Vector
The attack is initiated over the network against the router's diagnostic interface. An attacker with low-level credentials submits a crafted traceroute request that embeds shell metacharacters within the url parameter. The injected commands execute in the router's operating system context, allowing the attacker to read configuration, modify firewall rules, pivot into internal networks, or install persistent implants. Public disclosure of the exploit lowers the barrier to weaponization by opportunistic threat actors targeting exposed consumer routers.
No verified proof-of-concept code is included in this article. Refer to the VulDB CVE-2026-94095 entry and the Notion Vulnerability Report for disclosed technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-94095
Indicators of Compromise
- Unexpected child processes spawned by /usr/bin/network_tools, such as /bin/sh, wget, curl, busybox, or nc.
- Traceroute diagnostic HTTP requests containing shell metacharacters (;, |, &, `, $()) in the url parameter.
- Outbound connections from the router to unfamiliar hosts shortly after diagnostic requests are issued.
Detection Strategies
- Inspect router web-interface access logs for POST or GET requests to traceroute endpoints containing URL-encoded shell characters.
- Monitor network flow telemetry for anomalous outbound traffic originating from router management IPs, particularly to non-standard ports.
- Where possible, capture and review firmware syslog output for network_tools invocations with malformed url arguments.
Monitoring Recommendations
- Alert on any administrative diagnostic activity from IP addresses outside authorized management ranges.
- Track authentication events against the router's web interface and correlate with subsequent diagnostic requests.
- Baseline normal DNS and outbound HTTP traffic from network infrastructure and alert on deviations.
How to Mitigate CVE-2026-94095
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs or specific administrator IP addresses.
- Disable remote WAN-side administration on the NBR200V2 if it is currently exposed.
- Rotate all administrative credentials on the affected device to reduce the risk of authenticated exploitation.
- Consider replacing the device with a supported model, given the vendor's lack of response to the disclosure.
Patch Information
No vendor patch is available at the time of publication. Netcore did not respond to the researcher's disclosure attempts. Organizations operating the NBR200V2 on firmware 1.3.241127.071246 should assume the vulnerability will remain unpatched and plan compensating controls accordingly. Monitor the VulDB entry for CVE-2026-94095 for future updates from the vendor.
Workarounds
- Place the router behind an upstream firewall that blocks untrusted access to management ports (typically TCP/80 and TCP/443).
- Segment the router's management plane from user networks using VLANs or dedicated management interfaces.
- Disable the Traceroute Diagnostic Feature in the web interface if the option is available in the device configuration.
- Deploy network intrusion detection signatures that flag shell metacharacters in traceroute request parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
