CVE-2026-94099: Netcore NBR200V2 RCE Vulnerability

CVE-2026-94099 is a command injection flaw in Netcore NBR200V2 routers affecting the restore.cgi backup component. Attackers can execute arbitrary commands remotely via QUERY_STRING manipulation. This article covers technical details, affected versions, exploitation risks, and mitigation strategies.

CVE-2026-94099 Overview

CVE-2026-94099 is a command injection vulnerability in the Netcore NBR200V2 router running firmware version 1.3.241127.071246. The flaw resides in the restore.cgi script of the Backup Restore component. Attackers manipulate the QUERY_STRING argument to inject arbitrary operating system commands. The issue is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component. A public exploit has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers with low privileges can execute arbitrary operating system commands on affected Netcore NBR200V2 routers, leading to full device compromise, network pivoting, and traffic interception.

Affected Products

Netcore NBR200V2 router
Firmware version 1.3.241127.071246
Backup Restore component (restore.cgi)

Discovery Timeline

2026-09-21 - CVE-2026-94099 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94099

Vulnerability Analysis

The vulnerability affects the restore.cgi handler responsible for processing backup restore operations on the Netcore NBR200V2. The handler consumes the HTTP QUERY_STRING environment variable without proper sanitization. An attacker who can reach the web management interface supplies crafted query parameters that are passed to a shell context. Injected shell metacharacters break out of the intended command and execute attacker-controlled operating system commands.

Because the router firmware typically runs CGI scripts with elevated privileges, successful exploitation grants command execution with the same privilege level as the web server process. The public availability of a working exploit increases the likelihood of opportunistic scanning and mass exploitation targeting exposed devices.

Root Cause

The root cause is improper neutralization of special elements in the input passed to a downstream shell interpreter [CWE-74]. The restore.cgi script trusts the contents of QUERY_STRING and concatenates the value into a command executed by the underlying operating system. No input validation, escaping, or allowlisting is applied before invocation.

Attack Vector

Exploitation occurs over the network against the router's HTTP management interface. An attacker crafts a request to restore.cgi containing shell metacharacters in the query string. The vulnerability requires low privileges but no user interaction. See the VulDB entry for CVE-2026-94099 and the Notion vulnerability report for technical details on the injection payload structure.

// No verified exploit code is reproduced here.
// Refer to the VulDB advisory for public proof-of-concept details.

Detection Methods for CVE-2026-94099

Indicators of Compromise

HTTP requests to /restore.cgi containing shell metacharacters such as ;, |, `, $(, or && inside the query string.
Unexpected outbound connections from the router to unfamiliar hosts, indicating post-exploitation command-and-control activity.
New or modified processes on the device spawned by the web server user context.
Configuration or firmware changes not attributable to legitimate administrative actions.

Detection Strategies

Inspect web server access logs for requests to restore.cgi with unusual query string encodings or long parameter values.
Deploy network intrusion detection signatures that flag command injection patterns in HTTP requests to the router management interface.
Correlate router administrative traffic sources with an approved administrator IP allowlist and alert on deviations.

Monitoring Recommendations

Forward router syslog and web management logs to a centralized log platform for retention and analysis.
Baseline normal DNS and outbound traffic patterns from the router and alert on new destinations.
Monitor for repeated failed authentication attempts against the router web interface that may precede exploitation.

How to Mitigate CVE-2026-94099

Immediate Actions Required

Restrict access to the Netcore NBR200V2 web management interface to trusted internal management networks only.
Disable remote WAN-side administration on the affected devices immediately.
Rotate administrative credentials for the router and any accounts that may have been exposed through the interface.
Inventory network segments for exposed NBR200V2 devices and prioritize replacement or isolation.

Patch Information

No vendor patch is available. According to the CVE description, the vendor was contacted about this disclosure but did not respond. Organizations should assume the vulnerability remains unpatched and plan compensating controls or device replacement. Track updates through the VulDB advisory for CVE-2026-94099.

Workarounds

Place the affected router behind an upstream firewall that blocks unauthenticated access to the management interface.
Segment the router's management VLAN from user and production networks.
Replace the device with a vendor-supported alternative if operational requirements permit.

bash

# Example firewall rule restricting web management to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP