CVE-2026-4840
OS Command Injection in Netcore Power 15AX Diagnostic Tool Interface
Publication date: 2026-03-26
Last updated on: 2026-03-26
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netcore | power_15ax | to 3.0.0.6938 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary commands as root on the affected device, potentially leading to unauthorized access, data disclosure, and system compromise.
Such unauthorized access and potential data breaches could violate common security requirements in standards and regulations like GDPR and HIPAA, which mandate protection of sensitive data and system integrity.
Because the vulnerability enables attackers to read sensitive files, modify system configurations, and install malware or backdoors, it increases the risk of non-compliance with these regulations due to inadequate security controls.
Can you explain this vulnerability to me?
This vulnerability is an OS command injection flaw found in the Netcore POWER15AX wireless router firmware version 3.0.0.6938. It exists in the setTools function of the /bin/netis.cgi binary, which handles diagnostic tool requests like ping and traceroute.
The vulnerability occurs because the setTools function takes user input from the IpAddr parameter and inserts it directly into system commands without properly sanitizing or escaping dangerous shell characters. Although it blocks a few characters like space, pipe, semicolon, and ampersand, it fails to block other shell metacharacters such as $(), backticks, newlines, and redirection operators.
As a result, an attacker can inject arbitrary shell commands that get executed with root privileges on the device, potentially compromising the entire system remotely.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary commands on the affected device with root privileges.
- Attackers can read sensitive files such as /etc/passwd.
- They can modify system configurations or install malware and backdoors.
- It can lead to denial of service conditions or enable lateral movement within the network.
- Because the exploit has been publicly released, the risk of attacks is increased.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the affected CGI endpoint (likely /cgi-bin/skk_set.cgi or /skk_set.cgi) for command injection via the IpAddr parameter in HTTP POST requests.
A suggested detection method is to send a crafted HTTP POST request that attempts to inject a harmless command and then check for its effect on the system.
- Example HTTP POST payload: diagnostic=1&IpAddr=127.0.0.1$(id>/tmp/pwned)&type=1
After sending this request, verify if the file /tmp/pwned is created on the device, which would indicate successful command injection.
Detection also involves identifying the correct CGI endpoint and confirming if the device executes system commands with root privileges based on user input.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the management interface to trusted networks only and disabling WAN-side management to prevent remote exploitation.
Enforce strong authentication mechanisms to limit unauthorized access to the vulnerable diagnostic tool interface.
Monitor system logs for suspicious activity that may indicate exploitation attempts.
If possible, apply input validation by implementing a strict whitelist on the IpAddr parameter, allowing only alphanumeric characters, dots, hyphens, and colons.
Replace or patch the vulnerable system calls that execute user input commands, or upgrade the firmware once a patch is available.