CVE-2025-5145 Netcore POWER13 Query String cgi-bin command injection
MediumCVSS 5.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 20250508. This affects an unknown part of the file /www/cgi-bin/ of the component Query String Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netcore NBR1005GPEV2 | = 20250508 | No fix listed |
| netcore B6V2 | = 20250508 | No fix listed |
| netcore COVER5 | = 20250508 | No fix listed |
| netcore NAP830 | = 20250508 | No fix listed |
| netcore nap930 | = 20250508 | No fix listed |
| netcore nbr100v2 | = 20250508 | No fix listed |
| netcore nbr200v2 | = 20250508 | No fix listed |
| netcore power13 | = 20250508 | No fix listed |
References
- VDB-310233 | Netcore POWER13 Query String cgi-bin command injection technical-description vdb-entry
- VDB-310233 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-required signature
- Submit #573492 | Netcore NBR1005GPE;COVER5;NBR100;NBR200;POWER13;B6;NAP930;NAP830 NBR1005GPEV2_V1.3.241107.015153;NBR100V2 V1.3.240614.030928; NBR200V2 V1.3.241127.071246;NAP930 V0.1.241010.141410;NAP830 V0.1.2 Command Injection third-party-advisory
- github.com exploit
- anonymous.4open.science related