A critical OS command injection vulnerability in the Netcore POWER15AX router allows authenticated attackers to execute arbitrary code with root privileges.

The vulnerability exists in the setTools function within the /bin/netis.cgi binary, where improper input validation of the IpAddr parameter permits command injection via shell metacharacters. The flaw requires the attacker to have established authenticated access to the device to interact with the diagnostic tool functionality.

Successful exploitation grants an attacker full control over the affected router, potentially leading to unauthorized access to the local network, credential theft, or the use of the device in botnet activities. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational infrastructure, as it facilitates complete system compromise and potential lateral movement within the network.

Immediate Action: Review the vendor support page for firmware updates and apply the latest available patch to address the vulnerability in the setTools function. If a patch is not yet available, restrict access to the web management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from router management interfaces and review system logs for suspicious diagnostic tool execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter malicious payloads targeting the /cgi-bin/skk_set.cgi endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up at the provided GitHub reference.

This vulnerability presents a significant security risk due to the potential for full system compromise. Administrators are urged to prioritize the update of all affected Netcore POWER15AX devices to the latest firmware version immediately upon release to mitigate the threat of remote command execution.