A critical command injection vulnerability in Netcore NBR200V2 allows remote attackers to achieve full system compromise via the backup restore interface.

This is a command injection vulnerability (CWE-77) located in the restore.cgi script within the Backup Restore component. An attacker with low-level privileges can manipulate the QUERY_STRING argument to execute arbitrary commands on the underlying operating system.

The ability to execute arbitrary commands remotely presents a severe risk to organizational security, as it allows for unauthorized access, data exfiltration, and potential lateral movement within the network. With a CVSS score of 9.9, this vulnerability represents an imminent threat to the confidentiality, integrity, and availability of the affected device. Successful exploitation could lead to a total compromise of the appliance, resulting in significant operational disruption and potential exposure of sensitive internal traffic.

Immediate Action: As no official patch is currently available from the vendor, restrict network access to the management interface of the NBR200V2 and disable the Backup Restore functionality if it is not strictly required.

Proactive Monitoring: Monitor system logs for suspicious process execution, unauthorized attempts to access restore.cgi, or unexpected outbound network connections originating from the device.

Compensating Controls: Implement strict firewall rules to ensure that only authorized IP addresses can access the device management interface and deploy a Web Application Firewall (WAF) rule to inspect and block malicious payloads directed at the restore.cgi endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the CVE record.

Due to the critical severity of this vulnerability and the absence of a vendor-provided patch, organizations should treat this as a high-priority risk. Administrators must isolate the affected hardware from untrusted networks and implement rigorous access controls immediately to prevent remote exploitation. Continuous monitoring for signs of intrusion is essential until a formal resolution is provided by the manufacturer.