VulnSocial

CVE-2026-94095PoC

LOWCVSS 8.6 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 2 mentions (2026-09-21); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-09-21: 2Mentions · 2026-09-22: 2Mentions · 2026-10-20: 1PoC Mentioned / Linked · 2026-09-22: 2PoC Mentioned / Linked · 2026-10-20: 1Exploit Tool / Code · 2026-09-22: 1Technical Details · 2026-09-21: 1Technical Details · 2026-09-22: 2Technical Details · 2026-10-20: 109-2109-2210-20
Signal classification2 categories
PoC
360.0%
Disclosure
240.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-212
Disclosure2
2026-09-222
PoC2
2026-10-201
PoC1
Full discourse5 posts
  • Ryx@PadhiyarRushi
    PoC

    Netcore traceroute diagnostic → root RCE. CVE-2026-94095 (CVSS 9.9): command injection in /usr/bin/network_tools Traceroute feature via the url argument. Same NBR200V2 firmware family as the CVSS 10 diagnostic endpoint bug. Public PoC material is circulating! https://www.tenable.com/cve/CVE-2026-94095 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #RCE #IoT

    Post summary

    The post discloses a high‑severity command injection RCE in Netcore devices (CVE-2026-94095) and notes that public PoC material is circulating, without mentioning patches, exploits, or active wild use.

    11052553
    954 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🚨 CVE-2026-94095 — Netcore NBR200V2'de CVSS 9.9 kritik OS Command Injection açığı için PoC yayınlandı. V1.3.241127.071246 firmware'ında traceroute diagnostic işlevi, ubus JSON-RPC üzerinden alınan url değerini system() ile shell'e aktarıyor. Düşük yetkili oturum gerektiren saldırı ile root seviyesinde keyfi komut çalıştırılabiliyor. https://github.com/HackSpeak/CVE-2026-94095

    Post summary

    The tweet announces the release of a Proof of Concept for a critical OS Command Injection vulnerability (CVE-2026-94095) in the Netcore NBR200V2, including a link to the exploit code and technical details of the flaw.

    00020365
    2.5K followersView on X
  • Hugo | DevOps | Cybersecurity@HugoValters
    PoC

    CVE-2026-94095: command injection in Netcore NBR200V2 traceroute feature, CVSS 9.9, remotely exploitable, public exploit out, vendor unresponsive and unpatched. Restrict exposure and mitigate now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94095 #Netcore #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet announces CVE-2026-94095 as a command injection in Netcore NBR200V2 (CVSS 9.9) with a public exploit available, no vendor patch, and urges immediate mitigation.

    0000050
    1.1K followersView on X
  • cybrmonk@cybr_monk
    Disclosure

    CVE-2026-94095 Lets Attackers Run Commands on Netcore Routers via Traceroute https://cybrmonk.com/blog/cve-2026-94095-lets-attackers-run-commands-on-netcore-routers-via-traceroute #cybersecurity #threatintelligence https://t.co/KzHjdGWl9b

    Post summary

    The tweet announces CVE‑2026‑94095, describing an RCE via Netcore router traceroute, and links to a detailed blog post, but provides no PoC, exploit, patch, or active exploitation information.

    0000030
    45 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94095 A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of… https://www.cve.org/CVERecord?id=CVE-2026-94095

    Post summary

    The text is a brief vulnerability disclosure for CVE-2026-94095 affecting Netcore NBR200V2, noting an unknown issue in /usr/bin/network_tools, with no PoC, exploit, patch, or exploitation details beyond a link to the CVE record.

    000001.1K
    58.1K followersView on X

Explore more

Back to dashboard