Is CVE-2026-101001 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101001 being exploited in the wild.

How severe is CVE-2026-101001?

Critical severity, with a CVSS score of 10, published 28 September 2026.

Which products and versions are affected?

Netcore NBR200V2 1.3.241127.071246.

Is there a fix for CVE-2026-101001?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101001 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101001?

Check whether you run Netcore NBR200V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101001: Netcore NBR200V2 command injection in network_tools

CVE-2026-101001 · Severity: critical · CVSS 10 · Published 2026-09-28

The Netcore NBR200V2 router contains a critical flaw in its web management interface that allows attackers to execute arbitrary system commands remotely without authentication. An attacker can craft a malicious HTTP request to gain complete control over the router, potentially compromising network traffic and enabling lateral attacks into connected networks. This vulnerability affects the router's ability to safely process diagnostic commands.

Technologies: Netcore NBR200V2. Vendors: Netcore.

Quick answers

Is CVE-2026-101001 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101001 being exploited in the wild.
How severe is CVE-2026-101001?: Critical severity, with a CVSS score of 10, published 28 September 2026.
Which products and versions are affected?: Netcore NBR200V2 1.3.241127.071246.
Is there a fix for CVE-2026-101001?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101001 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101001?: Check whether you run Netcore NBR200V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an unauthenticated OS command injection in the /www/cgi-bin/network_tools CGI script, where user-supplied QUERY_STRING input is passed directly to eval() before authentication checks occur. The vulnerable code path parses URL parameters using eval without proper sanitization, as the urldecode() sanitization function is commented out. An attacker can send a crafted GET request to execute arbitrary shell commands with root privileges on the device.

Affected products

Netcore NBR200V2 1.3.241127.071246

Timeline

2026-09-28: disclosed
2026-09-28: other: Exploit code published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.