The Netcore NBR200V2 router is vulnerable to remote command injection, posing a critical risk of full system compromise for affected devices.

This vulnerability is a command injection flaw (CWE-77) residing in the /www/cgi-bin/upgrade file. An authenticated attacker with high privileges can trigger this flaw by injecting malicious commands into the QUERY_STRING parameter during the firmware upgrade process.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the affected network device. Given the CVSS score of 9.1, this flaw represents a critical threat, as it enables unauthorized administrative access, potential lateral movement into the internal network, and total loss of device integrity.

Immediate Action: As no official patch is currently available from the vendor, restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor device logs for unusual execution patterns or failed authentication attempts targeting the /www/cgi-bin/upgrade endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and sanitize incoming HTTP requests, specifically blocking suspicious characters within the QUERY_STRING parameter directed at the upgrade CGI script.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

The severity of this command injection vulnerability cannot be overstated, as it provides a direct path to full system control. Administrators must prioritize isolating the affected NBR200V2 units from the internet immediately and maintain strict access controls until a vendor-supplied firmware update is released and verified.