Netcore Products Command Injection Vulnerability in Query String Handler

A critical command injection vulnerability has been identified in multiple Netcore router and wireless access point models, including the NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2, and POWER13, all through version 20250508. The vulnerability resides in the Query String Handler component, specifically within the file '/www/cgi-bin/'. The issue arises from inadequate filtering of parameters in several scripts, allowing attackers to execute arbitrary commands that could harm the device's system.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected device, with potential commands like 'rm -rf /' being used to disrupt the router's operating system.