A critical command injection vulnerability in Netcore NBR200V2 allows unauthenticated remote attackers to achieve full system compromise.

This flaw is a command injection vulnerability (CWE-77) residing in the CGI Diagnostic Endpoint within the /www/cgi-bin/network_tools file. An unauthenticated attacker can manipulate the param, key, or val arguments to execute arbitrary system commands with the privileges of the web service.

The severity is rated as critical with a CVSS score of 10.0, reflecting the ability for an unauthenticated remote attacker to gain complete control over the affected device. Successful exploitation leads to total system compromise, potentially resulting in unauthorized data exfiltration, lateral movement within the network, and complete loss of availability for the affected networking equipment.

Immediate Action: Since no vendor patch is currently available, restrict network access to the management interface of the NBR200V2 device immediately to prevent reachability by unauthorized actors.

Proactive Monitoring: Monitor system logs and network traffic for suspicious requests directed at /www/cgi-bin/network_tools, specifically looking for shell metacharacters or encoded commands in the payload parameters.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to detect and block command injection patterns targeting CGI endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the vulnerability references.

Given the critical nature of this vulnerability and the absence of a vendor-supplied security update, organizations must prioritize isolating the affected hardware from all untrusted networks. Immediate implementation of network-level access controls is essential to mitigate the risk of unauthenticated remote code execution until a formal patch is released.