NAP930 (0.1.241010.141410) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/nap930-0.1.241010.141410/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 29 Sep 2026 02:23:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOS Command Injection in Netcore NAP930 via Network Tools CGIhttps://feed.craftedsignal.io/briefs/2026-09-netcore-cve/Tue, 29 Sep 2026 02:23:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-netcore-cve/An unauthenticated remote OS command injection vulnerability in the Netcore NAP930 router allows attackers to execute arbitrary system commands via the sid argument in the network_tools CGI component.A critical OS command injection vulnerability, identified as CVE-2026-102240, affects the Netcore NAP930 router version 0.1.241010.141410. The vulnerability resides within the Network Tools CGI component, specifically in the /www/cgi-bin/network_tools script. The eval function within this script fails to sanitize the sid argument before processing, allowing unauthenticated remote attackers to inject and execute arbitrary operating system commands. This flaw is particularly dangerous as it grants the attacker execution capabilities with high system privileges. The exploit code is publicly available, increasing the risk of exploitation by opportunistic actors. Despite attempts to contact the vendor, no response or patch has been issued, leaving devices vulnerable. Defenders should monitor for unexpected HTTP requests directed at the network_tools CGI endpoint, particularly those containing shell metacharacters in the query string parameters.

Impact

Successful exploitation of this vulnerability allows for complete system compromise of the affected Netcore NAP930 router. An attacker can gain persistent unauthorized access, exfiltrate data, or utilize the device as a node in botnet infrastructure. Given the critical CVSS score of 10.0 and public availability of exploit material, there is a high likelihood of automated exploitation attempts across internet-facing devices.

Recommendation

  • Block all inbound access to the web management interface of Netcore NAP930 routers from untrusted or public networks.
  • Implement strict access control lists (ACLs) to restrict access to the /www/cgi-bin/network_tools endpoint to known management IP addresses.
  • Monitor web server logs for incoming requests to /www/cgi-bin/network_tools that include characters such as semicolon, pipe, or backticks in the 'sid' parameter.
]]>criticaladvisoryvulnerabilityremote-code-executionnetwork-device