External risk intelligence

Netcore Router Remote Code Execution via Upgrade File

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78796

The vulnerability resides in a wireless router's firmware within the cgi-bin upgrade path. As an edge networking device intended to provide internet connectivity, routers are commonly deployed as internet-facing gateways. The specific component is an administrative or management interface function that is often accessible over the network, making it a highly likely target for remote, internet-based interaction.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts Netcore wireless routers, potentially allowing remote attackers to execute arbitrary code. The issue lies within the firmware's upgrade process, presenting a significant security risk if exploited. The primary concern is to confirm if this specific router model is in use and assess any potential exposure.

Remote code execution via router firmware.
Could impact network security and control.
Confirm router usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable upgrade file on Netcore routers from the internet. By sending a specially crafted request to the router's web interface, an attacker could exploit this vulnerability to execute arbitrary code. This could allow an attacker to take full control of the affected device.

No authentication needed.
Trigger via web interface upgrade file.
Complete device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code on the affected router by exploiting a flaw in its firmware upgrade process. This could impact the router's intended functionality and potentially expose network traffic or other sensitive data processed by the device.

Router firmware and configuration.
Unauthenticated remote code execution.
Compromised network security.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Netcore wireless routers, a type of edge network device commonly deployed as an internet gateway. Ownership likely falls to network infrastructure or platform teams responsible for managing network edge devices. The first practical step is to identify all deployed Netcore routers, confirm their reachability from the internet, and then assess business criticality before planning remediation.

Network infrastructure or platform teams own the issue.
Verify external reachability and business criticality.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netcore B11 Enterprise-level wireless router?

This is a 9-port Gigabit networking device designed for business environments. It acts as a gateway to route traffic between the internet and internal local networks, typically managing connectivity for multiple connected devices within a physical shop or office.

What does CWE-78 mean for CVE-2026-78796?

CWE-78 refers to OS Command Injection. In this context, it means the router's software incorrectly processes input before running system commands. An attacker can use this flaw to input malicious instructions that the device executes with full privileges, effectively gaining control over the router's operating system.

How can an attacker trigger this RCE vulnerability?

The flaw is triggered by sending a specially crafted request to the router's web-based management interface, specifically targeting the upgrade file path. Simply browsing the web or using the router for standard traffic does not trigger the bug; the attacker must intentionally send a malicious command string to that specific administrative file.

Is my Netcore router at risk if it is behind a firewall?

Halo Surface Signal indicates this router is commonly deployed as an internet-facing edge device. If your router is directly connected to the internet, it is at higher risk. Devices hidden behind a strict external firewall or those only accessible from a private, internal network have a smaller attack surface, though they remain vulnerable if an attacker gains access to your internal network.

What steps should I take if I use this Netcore device?

Start by auditing your network inventory to confirm if you are running the affected model and firmware version. Prioritize checking which devices are reachable from the public internet. Since this is a critical flaw, consult your vendor for official firmware updates and consider restricting access to the web interface to authorized management IPs only.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.