CVE-2026-102240

Name of the Vulnerable Software and Affected Versions Netcore NAP930 version 0.1.241010.141410

Description Remote OS command injection is possible within the Network Tools CGI component. The issue exists in the eval() function of the '/www/cgi-bin/network tools' endpoint, where improper handling of the sid variable allows an attacker to execute arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/www/cgi-bin/network tools' endpoint to minimize the risk of exploitation.