External risk intelligence

Netcore NAP930 Network Tools CGI OS Command Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-102240

The vulnerability affects a network-related CGI script on a router, a class of device commonly managed via web interfaces. Because this function is reachable via a web-based management component and can be accessed remotely, it is commonly deployed in an internet-facing configuration.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been publicly disclosed in a network device component, allowing remote attackers to inject and execute operating system commands. The vendor has not responded to inquiries regarding this issue.

Remote command execution vulnerability discovered.
Public exploit exists, impacting network devices.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can remotely reach a vulnerable function within the Network Tools CGI component of Netcore NAP930 routers by manipulating arguments passed to the `sid` parameter. This manipulation can lead to operating system command injection, allowing an attacker to execute arbitrary commands on the device. The exploit has been publicly disclosed and is considered ready for use.

Remote, unauthenticated network access required.
Manipulating the `sid` argument triggers vulnerability.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary commands on the affected system by manipulating a specific argument in the Network Tools CGI component. This could impact the integrity and availability of the device, and potentially lead to further compromise depending on the system's configuration.

System commands could be executed remotely.
Manipulation of the 'sid' argument may lead to injection.
Affected device integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical command injection vulnerability in Netcore NAP930's Network Tools CGI component requires immediate attention. System owners and the infrastructure team are likely responsible for identifying affected devices, assessing their reachability and business criticality, and coordinating remediation. The first practical step is to locate all instances of the affected technology, confirm exposure, identify the accountable owner, and then plan remediation based on risk.

Identify and assess affected systems.
Verify network reachability and business impact.
Plan and execute vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netcore NAP930 device?

The Netcore NAP930 is a network router. These devices serve as gateways to manage internet traffic and connectivity for connected users. The affected software component, Network Tools CGI, provides web-based management utilities that allow administrators to perform diagnostic tasks on the network device.

What does CVE-2026-102240 mean for security?

This vulnerability is an OS command injection flaw (CWE-77/78). It means the device's management interface improperly handles user-provided data. Instead of simply performing a network task, the software allows an attacker to insert and execute unauthorized system commands directly on the underlying operating system of the router.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specific, maliciously crafted request to the Network Tools CGI component over the network. By manipulating the 'sid' argument within that request, the attacker can force the device to run unintended commands. The vulnerability is not triggered by standard, legitimate navigation of the web interface or by using valid configuration parameters.

Do I need to worry if my router is internal?

Halo Surface Signal indicates that because this management function is accessible via a web interface and often deployed in internet-facing configurations, it poses a significant risk. If your router is directly exposed to the internet, it is at higher risk of remote attack. Internal devices are generally safer, though they remain vulnerable to local network users or compromised internal systems.

How should I respond to this vulnerability?

First, locate all Netcore NAP930 devices in your environment to determine if they are running the affected version. Assess whether these devices are accessible from outside your network. Since the vendor has not provided a response, prioritize restricting network access to the management interface to prevent unauthorized reachability while you determine further mitigation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.