Firmharness

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** Command injection is possible via remote manipulation of the `QUERY STRING` argument within the Firmware Upgrade CGI Endpoint. This issue occurs in the `/www/cgi-bin/upgrade` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** An issue in the Backup Restore component exists due to improper processing of the `restore.cgi` file. A remote attacker can achieve command injection by manipulating the `QUERY STRING` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** A buffer overflow can be triggered remotely within the WAN VLAN Reconfiguration component. The issue exists in the `wan config set vlan()` function located in the `/usr/bin/routerd` file. This occurs when the `vlan wanX.ports` argument is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** A buffer overflow can be triggered remotely via the `vlan load form uci` function within the `/usr/bin/routerd` file. This occurs when the `wan num` argument is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** An issue exists in the LAN IP Configuration Handler component within the `/usr/bin/network tools` file. A remote attacker can perform command injection by manipulating the `ipv4` argument. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** Command injection is possible in the CGI Diagnostic Endpoint component via the `/www/cgi-bin/network tools` endpoint. The issue occurs when the component processes the `param/key/val` argument, allowing externally supplied diagnostic input to influence command execution. This flaw can be exploited remotely without authentication or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict management reachability to designated administrative hosts and remove unnecessary public exposure. Review remote-maintenance and VPN access paths as well as WAN rules to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** An issue exists in the Traceroute Diagnostic Feature within the `/usr/bin/network tools` file. A remote attacker can trigger command injection by manipulating the `url` argument. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.