Netcore B11 router: Unauthenticated remote code execution via upgrade CGI
Summary
An input validation flaw in the web interface of the Netcore B11 shop wireless router, specifically the www/cgi-bin/upgrade file, allows a remote attacker to execute arbitrary commands on the device. According to public write-ups, the attack works without authentication by bypassing validation checks. A public proof-of-concept exploit has been published, and CISA SSVC rates exploitation as PoC with automatable attacks and total technical impact.
Affected
- Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router, firmware v1.3.241114.024540 and earlier
- Other Netcore models (for example B6, NBR100) may be affected according to a third-party write-up; unverified
Fixed in
Unknown. No vendor advisory or fixed firmware found.
Workaround
- Disable remote management and remove the web management interface from WAN access
- Restrict admin access to a management VLAN or trusted hosts
- No vendor countermeasure is known
Exploitation
- A public proof-of-concept exploit (exploit.py) has been published on Pastebin and GitHub.
- VulDB and PSIRT state no public exploit is available; sources conflict.
- Not listed in CISA KEV; no confirmed exploitation in the wild.
Our recommendation
- Identify all Netcore B11 units and confirm that none expose the web interface to the internet.
- Isolate affected routers from payment devices and sensitive networks, or replace them with a supported device.
- Ask Netcore or the distributor for a firmware fix and advisory.
- Monitor for unexpected outbound connections from the router.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PRISMI-Team VulnDisclos write-up github.com
- Pastebin exploit.py pastebin.com
- VulDB CVE-2026-78796 entry vuldb.com
- Rapid7 via Vulners vulners.com
- PSIRT CVE-2026-78796 psirt.com
- Positive Technologies via Vulners PT-2026-108950 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:05.
Original description (NVD)
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.