A critical command injection vulnerability in the Netcore NBR200V2 router allows remote attackers with low-level privileges to achieve full system compromise.

This flaw is a command injection vulnerability (CWE-77) located within the Traceroute Diagnostic Feature of the /usr/bin/network_tools file. An authenticated attacker with low privileges can manipulate the url parameter to execute arbitrary commands on the underlying operating system.

The CVSS score of 9.9 reflects a critical risk, as this vulnerability provides an attacker with the ability to execute unauthorized system-level commands remotely. Successful exploitation leads to full system compromise, which may result in data exfiltration, loss of network integrity, and the potential for the device to be used as a pivot point for further lateral movement within the internal network.

Immediate Action: As there is no confirmed patch available, immediately restrict access to the web management interface of the NBR200V2 device to trusted management subnets only.

Proactive Monitoring: Review system logs for suspicious activity involving the Traceroute utility or unusual process executions originating from the network_tools binary.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block malicious input containing shell metacharacters within the url parameter of diagnostic requests.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced advisory.

Given the critical severity of this command injection flaw and the existence of a public proof-of-concept, users must treat this as an urgent security risk. Because the vendor has not provided a patch, administrators should prioritize isolating affected devices from external network access to prevent unauthorized exploitation. Continuous monitoring of device logs is essential until a firmware update is released and verified.